cfg80211: Return beacon loss count in station
[linux-3.10.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include "core.h"
23 #include "nl80211.h"
24 #include "reg.h"
25
26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
28                                    struct genl_info *info,
29                                    struct cfg80211_crypto_settings *settings,
30                                    int cipher_limit);
31
32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
33                             struct genl_info *info);
34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
35                               struct genl_info *info);
36
37 /* the netlink family */
38 static struct genl_family nl80211_fam = {
39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
40         .name = "nl80211",      /* have users key off the name instead */
41         .hdrsize = 0,           /* no private header */
42         .version = 1,           /* no particular meaning now */
43         .maxattr = NL80211_ATTR_MAX,
44         .netnsok = true,
45         .pre_doit = nl80211_pre_doit,
46         .post_doit = nl80211_post_doit,
47 };
48
49 /* internal helper: get rdev and dev */
50 static int get_rdev_dev_by_ifindex(struct net *netns, struct nlattr **attrs,
51                                    struct cfg80211_registered_device **rdev,
52                                    struct net_device **dev)
53 {
54         int ifindex;
55
56         if (!attrs[NL80211_ATTR_IFINDEX])
57                 return -EINVAL;
58
59         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
60         *dev = dev_get_by_index(netns, ifindex);
61         if (!*dev)
62                 return -ENODEV;
63
64         *rdev = cfg80211_get_dev_from_ifindex(netns, ifindex);
65         if (IS_ERR(*rdev)) {
66                 dev_put(*dev);
67                 return PTR_ERR(*rdev);
68         }
69
70         return 0;
71 }
72
73 /* policy for the attributes */
74 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
75         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
76         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
77                                       .len = 20-1 },
78         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
79         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
80         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
81         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
82         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
83         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
84         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
85         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
86
87         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
88         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
89         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
90
91         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
92         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
93
94         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
95         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
96                                     .len = WLAN_MAX_KEY_LEN },
97         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
98         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
99         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
100         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
101         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
102
103         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
104         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
105         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
106                                        .len = IEEE80211_MAX_DATA_LEN },
107         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
108                                        .len = IEEE80211_MAX_DATA_LEN },
109         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
110         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
111         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
112         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
113                                                .len = NL80211_MAX_SUPP_RATES },
114         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
115         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
116         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
117         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
118                                 .len = IEEE80211_MAX_MESH_ID_LEN },
119         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
120
121         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
122         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
123
124         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
125         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
126         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
127         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
128                                            .len = NL80211_MAX_SUPP_RATES },
129         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
130
131         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
132         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
133
134         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
135
136         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
137         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
138                               .len = IEEE80211_MAX_DATA_LEN },
139         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
140         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
141
142         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
143                                 .len = IEEE80211_MAX_SSID_LEN },
144         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
145         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
146         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
147         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
148         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
149         [NL80211_ATTR_STA_FLAGS2] = {
150                 .len = sizeof(struct nl80211_sta_flag_update),
151         },
152         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
153         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
154         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
155         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
156         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
157         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
158         [NL80211_ATTR_PID] = { .type = NLA_U32 },
159         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
160         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
161                                  .len = WLAN_PMKID_LEN },
162         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
163         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
164         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
165         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
166                                  .len = IEEE80211_MAX_DATA_LEN },
167         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
168         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
169         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
170         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
171         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
172         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
173         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
174         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
175         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
176         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
177         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
178         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
179         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
180         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
181         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
182         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
183         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
184         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
185         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
186         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
187                                          .len = IEEE80211_MAX_DATA_LEN },
188         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
189                                          .len = IEEE80211_MAX_DATA_LEN },
190         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
191         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
192         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
193         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
194         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
195         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
196         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
197         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
198         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
199         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
200                                       .len = IEEE80211_MAX_DATA_LEN },
201         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
202         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
203         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
204                 .len = NL80211_HT_CAPABILITY_LEN
205         },
206         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
207 };
208
209 /* policy for the key attributes */
210 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
211         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
212         [NL80211_KEY_IDX] = { .type = NLA_U8 },
213         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
214         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
215         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
216         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
217         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
218         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
219 };
220
221 /* policy for the key default flags */
222 static const struct nla_policy
223 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
224         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
225         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
226 };
227
228 /* policy for WoWLAN attributes */
229 static const struct nla_policy
230 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
231         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
232         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
233         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
234         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
235         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
236         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
237         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
238         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
239 };
240
241 /* policy for GTK rekey offload attributes */
242 static const struct nla_policy
243 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
244         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
245         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
246         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
247 };
248
249 static const struct nla_policy
250 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
251         [NL80211_ATTR_SCHED_SCAN_MATCH_SSID] = { .type = NLA_BINARY,
252                                                  .len = IEEE80211_MAX_SSID_LEN },
253 };
254
255 /* ifidx get helper */
256 static int nl80211_get_ifidx(struct netlink_callback *cb)
257 {
258         int res;
259
260         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
261                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
262                           nl80211_policy);
263         if (res)
264                 return res;
265
266         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
267                 return -EINVAL;
268
269         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
270         if (!res)
271                 return -EINVAL;
272         return res;
273 }
274
275 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
276                                        struct netlink_callback *cb,
277                                        struct cfg80211_registered_device **rdev,
278                                        struct net_device **dev)
279 {
280         int ifidx = cb->args[0];
281         int err;
282
283         if (!ifidx)
284                 ifidx = nl80211_get_ifidx(cb);
285         if (ifidx < 0)
286                 return ifidx;
287
288         cb->args[0] = ifidx;
289
290         rtnl_lock();
291
292         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
293         if (!*dev) {
294                 err = -ENODEV;
295                 goto out_rtnl;
296         }
297
298         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
299         if (IS_ERR(*rdev)) {
300                 err = PTR_ERR(*rdev);
301                 goto out_rtnl;
302         }
303
304         return 0;
305  out_rtnl:
306         rtnl_unlock();
307         return err;
308 }
309
310 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
311 {
312         cfg80211_unlock_rdev(rdev);
313         rtnl_unlock();
314 }
315
316 /* IE validation */
317 static bool is_valid_ie_attr(const struct nlattr *attr)
318 {
319         const u8 *pos;
320         int len;
321
322         if (!attr)
323                 return true;
324
325         pos = nla_data(attr);
326         len = nla_len(attr);
327
328         while (len) {
329                 u8 elemlen;
330
331                 if (len < 2)
332                         return false;
333                 len -= 2;
334
335                 elemlen = pos[1];
336                 if (elemlen > len)
337                         return false;
338
339                 len -= elemlen;
340                 pos += 2 + elemlen;
341         }
342
343         return true;
344 }
345
346 /* message building helper */
347 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
348                                    int flags, u8 cmd)
349 {
350         /* since there is no private header just add the generic one */
351         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
352 }
353
354 static int nl80211_msg_put_channel(struct sk_buff *msg,
355                                    struct ieee80211_channel *chan)
356 {
357         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
358                     chan->center_freq);
359
360         if (chan->flags & IEEE80211_CHAN_DISABLED)
361                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
362         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
363                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
364         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
365                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
366         if (chan->flags & IEEE80211_CHAN_RADAR)
367                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
368
369         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
370                     DBM_TO_MBM(chan->max_power));
371
372         return 0;
373
374  nla_put_failure:
375         return -ENOBUFS;
376 }
377
378 /* netlink command implementations */
379
380 struct key_parse {
381         struct key_params p;
382         int idx;
383         int type;
384         bool def, defmgmt;
385         bool def_uni, def_multi;
386 };
387
388 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
389 {
390         struct nlattr *tb[NL80211_KEY_MAX + 1];
391         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
392                                    nl80211_key_policy);
393         if (err)
394                 return err;
395
396         k->def = !!tb[NL80211_KEY_DEFAULT];
397         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
398
399         if (k->def) {
400                 k->def_uni = true;
401                 k->def_multi = true;
402         }
403         if (k->defmgmt)
404                 k->def_multi = true;
405
406         if (tb[NL80211_KEY_IDX])
407                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
408
409         if (tb[NL80211_KEY_DATA]) {
410                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
411                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
412         }
413
414         if (tb[NL80211_KEY_SEQ]) {
415                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
416                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
417         }
418
419         if (tb[NL80211_KEY_CIPHER])
420                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
421
422         if (tb[NL80211_KEY_TYPE]) {
423                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
424                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
425                         return -EINVAL;
426         }
427
428         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
429                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
430                 int err = nla_parse_nested(kdt,
431                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
432                                            tb[NL80211_KEY_DEFAULT_TYPES],
433                                            nl80211_key_default_policy);
434                 if (err)
435                         return err;
436
437                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
438                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
439         }
440
441         return 0;
442 }
443
444 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
445 {
446         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
447                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
448                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
449         }
450
451         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
452                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
453                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
454         }
455
456         if (info->attrs[NL80211_ATTR_KEY_IDX])
457                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
458
459         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
460                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
461
462         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
463         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
464
465         if (k->def) {
466                 k->def_uni = true;
467                 k->def_multi = true;
468         }
469         if (k->defmgmt)
470                 k->def_multi = true;
471
472         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
473                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
474                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
475                         return -EINVAL;
476         }
477
478         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
479                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
480                 int err = nla_parse_nested(
481                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
482                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
483                                 nl80211_key_default_policy);
484                 if (err)
485                         return err;
486
487                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
488                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
489         }
490
491         return 0;
492 }
493
494 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
495 {
496         int err;
497
498         memset(k, 0, sizeof(*k));
499         k->idx = -1;
500         k->type = -1;
501
502         if (info->attrs[NL80211_ATTR_KEY])
503                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
504         else
505                 err = nl80211_parse_key_old(info, k);
506
507         if (err)
508                 return err;
509
510         if (k->def && k->defmgmt)
511                 return -EINVAL;
512
513         if (k->defmgmt) {
514                 if (k->def_uni || !k->def_multi)
515                         return -EINVAL;
516         }
517
518         if (k->idx != -1) {
519                 if (k->defmgmt) {
520                         if (k->idx < 4 || k->idx > 5)
521                                 return -EINVAL;
522                 } else if (k->def) {
523                         if (k->idx < 0 || k->idx > 3)
524                                 return -EINVAL;
525                 } else {
526                         if (k->idx < 0 || k->idx > 5)
527                                 return -EINVAL;
528                 }
529         }
530
531         return 0;
532 }
533
534 static struct cfg80211_cached_keys *
535 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
536                        struct nlattr *keys)
537 {
538         struct key_parse parse;
539         struct nlattr *key;
540         struct cfg80211_cached_keys *result;
541         int rem, err, def = 0;
542
543         result = kzalloc(sizeof(*result), GFP_KERNEL);
544         if (!result)
545                 return ERR_PTR(-ENOMEM);
546
547         result->def = -1;
548         result->defmgmt = -1;
549
550         nla_for_each_nested(key, keys, rem) {
551                 memset(&parse, 0, sizeof(parse));
552                 parse.idx = -1;
553
554                 err = nl80211_parse_key_new(key, &parse);
555                 if (err)
556                         goto error;
557                 err = -EINVAL;
558                 if (!parse.p.key)
559                         goto error;
560                 if (parse.idx < 0 || parse.idx > 4)
561                         goto error;
562                 if (parse.def) {
563                         if (def)
564                                 goto error;
565                         def = 1;
566                         result->def = parse.idx;
567                         if (!parse.def_uni || !parse.def_multi)
568                                 goto error;
569                 } else if (parse.defmgmt)
570                         goto error;
571                 err = cfg80211_validate_key_settings(rdev, &parse.p,
572                                                      parse.idx, false, NULL);
573                 if (err)
574                         goto error;
575                 result->params[parse.idx].cipher = parse.p.cipher;
576                 result->params[parse.idx].key_len = parse.p.key_len;
577                 result->params[parse.idx].key = result->data[parse.idx];
578                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
579         }
580
581         return result;
582  error:
583         kfree(result);
584         return ERR_PTR(err);
585 }
586
587 static int nl80211_key_allowed(struct wireless_dev *wdev)
588 {
589         ASSERT_WDEV_LOCK(wdev);
590
591         switch (wdev->iftype) {
592         case NL80211_IFTYPE_AP:
593         case NL80211_IFTYPE_AP_VLAN:
594         case NL80211_IFTYPE_P2P_GO:
595         case NL80211_IFTYPE_MESH_POINT:
596                 break;
597         case NL80211_IFTYPE_ADHOC:
598                 if (!wdev->current_bss)
599                         return -ENOLINK;
600                 break;
601         case NL80211_IFTYPE_STATION:
602         case NL80211_IFTYPE_P2P_CLIENT:
603                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
604                         return -ENOLINK;
605                 break;
606         default:
607                 return -EINVAL;
608         }
609
610         return 0;
611 }
612
613 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
614 {
615         struct nlattr *nl_modes = nla_nest_start(msg, attr);
616         int i;
617
618         if (!nl_modes)
619                 goto nla_put_failure;
620
621         i = 0;
622         while (ifmodes) {
623                 if (ifmodes & 1)
624                         NLA_PUT_FLAG(msg, i);
625                 ifmodes >>= 1;
626                 i++;
627         }
628
629         nla_nest_end(msg, nl_modes);
630         return 0;
631
632 nla_put_failure:
633         return -ENOBUFS;
634 }
635
636 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
637                                           struct sk_buff *msg)
638 {
639         struct nlattr *nl_combis;
640         int i, j;
641
642         nl_combis = nla_nest_start(msg,
643                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
644         if (!nl_combis)
645                 goto nla_put_failure;
646
647         for (i = 0; i < wiphy->n_iface_combinations; i++) {
648                 const struct ieee80211_iface_combination *c;
649                 struct nlattr *nl_combi, *nl_limits;
650
651                 c = &wiphy->iface_combinations[i];
652
653                 nl_combi = nla_nest_start(msg, i + 1);
654                 if (!nl_combi)
655                         goto nla_put_failure;
656
657                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
658                 if (!nl_limits)
659                         goto nla_put_failure;
660
661                 for (j = 0; j < c->n_limits; j++) {
662                         struct nlattr *nl_limit;
663
664                         nl_limit = nla_nest_start(msg, j + 1);
665                         if (!nl_limit)
666                                 goto nla_put_failure;
667                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
668                                     c->limits[j].max);
669                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
670                                                 c->limits[j].types))
671                                 goto nla_put_failure;
672                         nla_nest_end(msg, nl_limit);
673                 }
674
675                 nla_nest_end(msg, nl_limits);
676
677                 if (c->beacon_int_infra_match)
678                         NLA_PUT_FLAG(msg,
679                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
680                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
681                             c->num_different_channels);
682                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
683                             c->max_interfaces);
684
685                 nla_nest_end(msg, nl_combi);
686         }
687
688         nla_nest_end(msg, nl_combis);
689
690         return 0;
691 nla_put_failure:
692         return -ENOBUFS;
693 }
694
695 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
696                               struct cfg80211_registered_device *dev)
697 {
698         void *hdr;
699         struct nlattr *nl_bands, *nl_band;
700         struct nlattr *nl_freqs, *nl_freq;
701         struct nlattr *nl_rates, *nl_rate;
702         struct nlattr *nl_cmds;
703         enum ieee80211_band band;
704         struct ieee80211_channel *chan;
705         struct ieee80211_rate *rate;
706         int i;
707         const struct ieee80211_txrx_stypes *mgmt_stypes =
708                                 dev->wiphy.mgmt_stypes;
709
710         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
711         if (!hdr)
712                 return -1;
713
714         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
715         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
716
717         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
718                     cfg80211_rdev_list_generation);
719
720         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
721                    dev->wiphy.retry_short);
722         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
723                    dev->wiphy.retry_long);
724         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
725                     dev->wiphy.frag_threshold);
726         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
727                     dev->wiphy.rts_threshold);
728         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
729                     dev->wiphy.coverage_class);
730         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
731                    dev->wiphy.max_scan_ssids);
732         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
733                    dev->wiphy.max_sched_scan_ssids);
734         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
735                     dev->wiphy.max_scan_ie_len);
736         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
737                     dev->wiphy.max_sched_scan_ie_len);
738         NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
739                    dev->wiphy.max_match_sets);
740
741         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
742                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
743         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
744                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
745         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
746                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
747         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
748                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
749         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)
750                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_SUPPORT);
751         if (dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)
752                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP);
753
754         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
755                 sizeof(u32) * dev->wiphy.n_cipher_suites,
756                 dev->wiphy.cipher_suites);
757
758         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
759                    dev->wiphy.max_num_pmkids);
760
761         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
762                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
763
764         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
765                     dev->wiphy.available_antennas_tx);
766         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
767                     dev->wiphy.available_antennas_rx);
768
769         if (dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD)
770                 NLA_PUT_U32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
771                             dev->wiphy.probe_resp_offload);
772
773         if ((dev->wiphy.available_antennas_tx ||
774              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
775                 u32 tx_ant = 0, rx_ant = 0;
776                 int res;
777                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
778                 if (!res) {
779                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
780                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
781                 }
782         }
783
784         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
785                                 dev->wiphy.interface_modes))
786                 goto nla_put_failure;
787
788         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
789         if (!nl_bands)
790                 goto nla_put_failure;
791
792         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
793                 if (!dev->wiphy.bands[band])
794                         continue;
795
796                 nl_band = nla_nest_start(msg, band);
797                 if (!nl_band)
798                         goto nla_put_failure;
799
800                 /* add HT info */
801                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
802                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
803                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
804                                 &dev->wiphy.bands[band]->ht_cap.mcs);
805                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
806                                 dev->wiphy.bands[band]->ht_cap.cap);
807                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
808                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
809                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
810                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
811                 }
812
813                 /* add frequencies */
814                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
815                 if (!nl_freqs)
816                         goto nla_put_failure;
817
818                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
819                         nl_freq = nla_nest_start(msg, i);
820                         if (!nl_freq)
821                                 goto nla_put_failure;
822
823                         chan = &dev->wiphy.bands[band]->channels[i];
824
825                         if (nl80211_msg_put_channel(msg, chan))
826                                 goto nla_put_failure;
827
828                         nla_nest_end(msg, nl_freq);
829                 }
830
831                 nla_nest_end(msg, nl_freqs);
832
833                 /* add bitrates */
834                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
835                 if (!nl_rates)
836                         goto nla_put_failure;
837
838                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
839                         nl_rate = nla_nest_start(msg, i);
840                         if (!nl_rate)
841                                 goto nla_put_failure;
842
843                         rate = &dev->wiphy.bands[band]->bitrates[i];
844                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
845                                     rate->bitrate);
846                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
847                                 NLA_PUT_FLAG(msg,
848                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
849
850                         nla_nest_end(msg, nl_rate);
851                 }
852
853                 nla_nest_end(msg, nl_rates);
854
855                 nla_nest_end(msg, nl_band);
856         }
857         nla_nest_end(msg, nl_bands);
858
859         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
860         if (!nl_cmds)
861                 goto nla_put_failure;
862
863         i = 0;
864 #define CMD(op, n)                                              \
865          do {                                                   \
866                 if (dev->ops->op) {                             \
867                         i++;                                    \
868                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
869                 }                                               \
870         } while (0)
871
872         CMD(add_virtual_intf, NEW_INTERFACE);
873         CMD(change_virtual_intf, SET_INTERFACE);
874         CMD(add_key, NEW_KEY);
875         CMD(add_beacon, NEW_BEACON);
876         CMD(add_station, NEW_STATION);
877         CMD(add_mpath, NEW_MPATH);
878         CMD(update_mesh_config, SET_MESH_CONFIG);
879         CMD(change_bss, SET_BSS);
880         CMD(auth, AUTHENTICATE);
881         CMD(assoc, ASSOCIATE);
882         CMD(deauth, DEAUTHENTICATE);
883         CMD(disassoc, DISASSOCIATE);
884         CMD(join_ibss, JOIN_IBSS);
885         CMD(join_mesh, JOIN_MESH);
886         CMD(set_pmksa, SET_PMKSA);
887         CMD(del_pmksa, DEL_PMKSA);
888         CMD(flush_pmksa, FLUSH_PMKSA);
889         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
890                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
891         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
892         CMD(mgmt_tx, FRAME);
893         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
894         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
895                 i++;
896                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
897         }
898         CMD(set_channel, SET_CHANNEL);
899         CMD(set_wds_peer, SET_WDS_PEER);
900         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
901                 CMD(tdls_mgmt, TDLS_MGMT);
902                 CMD(tdls_oper, TDLS_OPER);
903         }
904         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
905                 CMD(sched_scan_start, START_SCHED_SCAN);
906         CMD(probe_client, PROBE_CLIENT);
907         CMD(set_noack_map, SET_NOACK_MAP);
908         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
909                 i++;
910                 NLA_PUT_U32(msg, i, NL80211_CMD_REGISTER_BEACONS);
911         }
912
913 #ifdef CONFIG_NL80211_TESTMODE
914         CMD(testmode_cmd, TESTMODE);
915 #endif
916
917 #undef CMD
918
919         if (dev->ops->connect || dev->ops->auth) {
920                 i++;
921                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
922         }
923
924         if (dev->ops->disconnect || dev->ops->deauth) {
925                 i++;
926                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
927         }
928
929         nla_nest_end(msg, nl_cmds);
930
931         if (dev->ops->remain_on_channel &&
932             dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
933                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
934                             dev->wiphy.max_remain_on_channel_duration);
935
936         if (dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)
937                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
938
939         if (mgmt_stypes) {
940                 u16 stypes;
941                 struct nlattr *nl_ftypes, *nl_ifs;
942                 enum nl80211_iftype ift;
943
944                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
945                 if (!nl_ifs)
946                         goto nla_put_failure;
947
948                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
949                         nl_ftypes = nla_nest_start(msg, ift);
950                         if (!nl_ftypes)
951                                 goto nla_put_failure;
952                         i = 0;
953                         stypes = mgmt_stypes[ift].tx;
954                         while (stypes) {
955                                 if (stypes & 1)
956                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
957                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
958                                 stypes >>= 1;
959                                 i++;
960                         }
961                         nla_nest_end(msg, nl_ftypes);
962                 }
963
964                 nla_nest_end(msg, nl_ifs);
965
966                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
967                 if (!nl_ifs)
968                         goto nla_put_failure;
969
970                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
971                         nl_ftypes = nla_nest_start(msg, ift);
972                         if (!nl_ftypes)
973                                 goto nla_put_failure;
974                         i = 0;
975                         stypes = mgmt_stypes[ift].rx;
976                         while (stypes) {
977                                 if (stypes & 1)
978                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
979                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
980                                 stypes >>= 1;
981                                 i++;
982                         }
983                         nla_nest_end(msg, nl_ftypes);
984                 }
985                 nla_nest_end(msg, nl_ifs);
986         }
987
988         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
989                 struct nlattr *nl_wowlan;
990
991                 nl_wowlan = nla_nest_start(msg,
992                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
993                 if (!nl_wowlan)
994                         goto nla_put_failure;
995
996                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
997                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
998                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
999                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
1000                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
1001                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
1002                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
1003                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
1004                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
1005                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
1006                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
1007                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
1008                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
1009                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
1010                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
1011                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
1012                 if (dev->wiphy.wowlan.n_patterns) {
1013                         struct nl80211_wowlan_pattern_support pat = {
1014                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1015                                 .min_pattern_len =
1016                                         dev->wiphy.wowlan.pattern_min_len,
1017                                 .max_pattern_len =
1018                                         dev->wiphy.wowlan.pattern_max_len,
1019                         };
1020                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1021                                 sizeof(pat), &pat);
1022                 }
1023
1024                 nla_nest_end(msg, nl_wowlan);
1025         }
1026
1027         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1028                                 dev->wiphy.software_iftypes))
1029                 goto nla_put_failure;
1030
1031         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1032                 goto nla_put_failure;
1033
1034         if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME)
1035                 NLA_PUT_U32(msg, NL80211_ATTR_DEVICE_AP_SME,
1036                             dev->wiphy.ap_sme_capa);
1037
1038         NLA_PUT_U32(msg, NL80211_ATTR_FEATURE_FLAGS, dev->wiphy.features);
1039
1040         if (dev->wiphy.ht_capa_mod_mask)
1041                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1042                         sizeof(*dev->wiphy.ht_capa_mod_mask),
1043                         dev->wiphy.ht_capa_mod_mask);
1044
1045         return genlmsg_end(msg, hdr);
1046
1047  nla_put_failure:
1048         genlmsg_cancel(msg, hdr);
1049         return -EMSGSIZE;
1050 }
1051
1052 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1053 {
1054         int idx = 0;
1055         int start = cb->args[0];
1056         struct cfg80211_registered_device *dev;
1057
1058         mutex_lock(&cfg80211_mutex);
1059         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1060                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1061                         continue;
1062                 if (++idx <= start)
1063                         continue;
1064                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1065                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1066                                        dev) < 0) {
1067                         idx--;
1068                         break;
1069                 }
1070         }
1071         mutex_unlock(&cfg80211_mutex);
1072
1073         cb->args[0] = idx;
1074
1075         return skb->len;
1076 }
1077
1078 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1079 {
1080         struct sk_buff *msg;
1081         struct cfg80211_registered_device *dev = info->user_ptr[0];
1082
1083         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1084         if (!msg)
1085                 return -ENOMEM;
1086
1087         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1088                 nlmsg_free(msg);
1089                 return -ENOBUFS;
1090         }
1091
1092         return genlmsg_reply(msg, info);
1093 }
1094
1095 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1096         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1097         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1098         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1099         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1100         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1101 };
1102
1103 static int parse_txq_params(struct nlattr *tb[],
1104                             struct ieee80211_txq_params *txq_params)
1105 {
1106         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1107             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1108             !tb[NL80211_TXQ_ATTR_AIFS])
1109                 return -EINVAL;
1110
1111         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1112         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1113         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1114         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1115         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1116
1117         return 0;
1118 }
1119
1120 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1121 {
1122         /*
1123          * You can only set the channel explicitly for AP, mesh
1124          * and WDS type interfaces; all others have their channel
1125          * managed via their respective "establish a connection"
1126          * command (connect, join, ...)
1127          *
1128          * Monitors are special as they are normally slaved to
1129          * whatever else is going on, so they behave as though
1130          * you tried setting the wiphy channel itself.
1131          */
1132         return !wdev ||
1133                 wdev->iftype == NL80211_IFTYPE_AP ||
1134                 wdev->iftype == NL80211_IFTYPE_WDS ||
1135                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1136                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1137                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1138 }
1139
1140 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1141                                  struct wireless_dev *wdev,
1142                                  struct genl_info *info)
1143 {
1144         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1145         u32 freq;
1146         int result;
1147
1148         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1149                 return -EINVAL;
1150
1151         if (!nl80211_can_set_dev_channel(wdev))
1152                 return -EOPNOTSUPP;
1153
1154         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1155                 channel_type = nla_get_u32(info->attrs[
1156                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1157                 if (channel_type != NL80211_CHAN_NO_HT &&
1158                     channel_type != NL80211_CHAN_HT20 &&
1159                     channel_type != NL80211_CHAN_HT40PLUS &&
1160                     channel_type != NL80211_CHAN_HT40MINUS)
1161                         return -EINVAL;
1162         }
1163
1164         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1165
1166         mutex_lock(&rdev->devlist_mtx);
1167         if (wdev) {
1168                 wdev_lock(wdev);
1169                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1170                 wdev_unlock(wdev);
1171         } else {
1172                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1173         }
1174         mutex_unlock(&rdev->devlist_mtx);
1175
1176         return result;
1177 }
1178
1179 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1180 {
1181         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1182         struct net_device *netdev = info->user_ptr[1];
1183
1184         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1185 }
1186
1187 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1188 {
1189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1190         struct net_device *dev = info->user_ptr[1];
1191         struct wireless_dev *wdev = dev->ieee80211_ptr;
1192         const u8 *bssid;
1193
1194         if (!info->attrs[NL80211_ATTR_MAC])
1195                 return -EINVAL;
1196
1197         if (netif_running(dev))
1198                 return -EBUSY;
1199
1200         if (!rdev->ops->set_wds_peer)
1201                 return -EOPNOTSUPP;
1202
1203         if (wdev->iftype != NL80211_IFTYPE_WDS)
1204                 return -EOPNOTSUPP;
1205
1206         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1207         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1208 }
1209
1210
1211 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1212 {
1213         struct cfg80211_registered_device *rdev;
1214         struct net_device *netdev = NULL;
1215         struct wireless_dev *wdev;
1216         int result = 0, rem_txq_params = 0;
1217         struct nlattr *nl_txq_params;
1218         u32 changed;
1219         u8 retry_short = 0, retry_long = 0;
1220         u32 frag_threshold = 0, rts_threshold = 0;
1221         u8 coverage_class = 0;
1222
1223         /*
1224          * Try to find the wiphy and netdev. Normally this
1225          * function shouldn't need the netdev, but this is
1226          * done for backward compatibility -- previously
1227          * setting the channel was done per wiphy, but now
1228          * it is per netdev. Previous userland like hostapd
1229          * also passed a netdev to set_wiphy, so that it is
1230          * possible to let that go to the right netdev!
1231          */
1232         mutex_lock(&cfg80211_mutex);
1233
1234         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1235                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1236
1237                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1238                 if (netdev && netdev->ieee80211_ptr) {
1239                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1240                         mutex_lock(&rdev->mtx);
1241                 } else
1242                         netdev = NULL;
1243         }
1244
1245         if (!netdev) {
1246                 rdev = __cfg80211_rdev_from_info(info);
1247                 if (IS_ERR(rdev)) {
1248                         mutex_unlock(&cfg80211_mutex);
1249                         return PTR_ERR(rdev);
1250                 }
1251                 wdev = NULL;
1252                 netdev = NULL;
1253                 result = 0;
1254
1255                 mutex_lock(&rdev->mtx);
1256         } else if (netif_running(netdev) &&
1257                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1258                 wdev = netdev->ieee80211_ptr;
1259         else
1260                 wdev = NULL;
1261
1262         /*
1263          * end workaround code, by now the rdev is available
1264          * and locked, and wdev may or may not be NULL.
1265          */
1266
1267         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1268                 result = cfg80211_dev_rename(
1269                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1270
1271         mutex_unlock(&cfg80211_mutex);
1272
1273         if (result)
1274                 goto bad_res;
1275
1276         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1277                 struct ieee80211_txq_params txq_params;
1278                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1279
1280                 if (!rdev->ops->set_txq_params) {
1281                         result = -EOPNOTSUPP;
1282                         goto bad_res;
1283                 }
1284
1285                 if (!netdev) {
1286                         result = -EINVAL;
1287                         goto bad_res;
1288                 }
1289
1290                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1291                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1292                         result = -EINVAL;
1293                         goto bad_res;
1294                 }
1295
1296                 nla_for_each_nested(nl_txq_params,
1297                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1298                                     rem_txq_params) {
1299                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1300                                   nla_data(nl_txq_params),
1301                                   nla_len(nl_txq_params),
1302                                   txq_params_policy);
1303                         result = parse_txq_params(tb, &txq_params);
1304                         if (result)
1305                                 goto bad_res;
1306
1307                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1308                                                            netdev,
1309                                                            &txq_params);
1310                         if (result)
1311                                 goto bad_res;
1312                 }
1313         }
1314
1315         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1316                 result = __nl80211_set_channel(rdev, wdev, info);
1317                 if (result)
1318                         goto bad_res;
1319         }
1320
1321         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1322                 enum nl80211_tx_power_setting type;
1323                 int idx, mbm = 0;
1324
1325                 if (!rdev->ops->set_tx_power) {
1326                         result = -EOPNOTSUPP;
1327                         goto bad_res;
1328                 }
1329
1330                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1331                 type = nla_get_u32(info->attrs[idx]);
1332
1333                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1334                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1335                         result = -EINVAL;
1336                         goto bad_res;
1337                 }
1338
1339                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1340                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1341                         mbm = nla_get_u32(info->attrs[idx]);
1342                 }
1343
1344                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1345                 if (result)
1346                         goto bad_res;
1347         }
1348
1349         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1350             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1351                 u32 tx_ant, rx_ant;
1352                 if ((!rdev->wiphy.available_antennas_tx &&
1353                      !rdev->wiphy.available_antennas_rx) ||
1354                     !rdev->ops->set_antenna) {
1355                         result = -EOPNOTSUPP;
1356                         goto bad_res;
1357                 }
1358
1359                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1360                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1361
1362                 /* reject antenna configurations which don't match the
1363                  * available antenna masks, except for the "all" mask */
1364                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1365                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1366                         result = -EINVAL;
1367                         goto bad_res;
1368                 }
1369
1370                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1371                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1372
1373                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1374                 if (result)
1375                         goto bad_res;
1376         }
1377
1378         changed = 0;
1379
1380         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1381                 retry_short = nla_get_u8(
1382                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1383                 if (retry_short == 0) {
1384                         result = -EINVAL;
1385                         goto bad_res;
1386                 }
1387                 changed |= WIPHY_PARAM_RETRY_SHORT;
1388         }
1389
1390         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1391                 retry_long = nla_get_u8(
1392                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1393                 if (retry_long == 0) {
1394                         result = -EINVAL;
1395                         goto bad_res;
1396                 }
1397                 changed |= WIPHY_PARAM_RETRY_LONG;
1398         }
1399
1400         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1401                 frag_threshold = nla_get_u32(
1402                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1403                 if (frag_threshold < 256) {
1404                         result = -EINVAL;
1405                         goto bad_res;
1406                 }
1407                 if (frag_threshold != (u32) -1) {
1408                         /*
1409                          * Fragments (apart from the last one) are required to
1410                          * have even length. Make the fragmentation code
1411                          * simpler by stripping LSB should someone try to use
1412                          * odd threshold value.
1413                          */
1414                         frag_threshold &= ~0x1;
1415                 }
1416                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1417         }
1418
1419         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1420                 rts_threshold = nla_get_u32(
1421                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1422                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1423         }
1424
1425         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1426                 coverage_class = nla_get_u8(
1427                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1428                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1429         }
1430
1431         if (changed) {
1432                 u8 old_retry_short, old_retry_long;
1433                 u32 old_frag_threshold, old_rts_threshold;
1434                 u8 old_coverage_class;
1435
1436                 if (!rdev->ops->set_wiphy_params) {
1437                         result = -EOPNOTSUPP;
1438                         goto bad_res;
1439                 }
1440
1441                 old_retry_short = rdev->wiphy.retry_short;
1442                 old_retry_long = rdev->wiphy.retry_long;
1443                 old_frag_threshold = rdev->wiphy.frag_threshold;
1444                 old_rts_threshold = rdev->wiphy.rts_threshold;
1445                 old_coverage_class = rdev->wiphy.coverage_class;
1446
1447                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1448                         rdev->wiphy.retry_short = retry_short;
1449                 if (changed & WIPHY_PARAM_RETRY_LONG)
1450                         rdev->wiphy.retry_long = retry_long;
1451                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1452                         rdev->wiphy.frag_threshold = frag_threshold;
1453                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1454                         rdev->wiphy.rts_threshold = rts_threshold;
1455                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1456                         rdev->wiphy.coverage_class = coverage_class;
1457
1458                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1459                 if (result) {
1460                         rdev->wiphy.retry_short = old_retry_short;
1461                         rdev->wiphy.retry_long = old_retry_long;
1462                         rdev->wiphy.frag_threshold = old_frag_threshold;
1463                         rdev->wiphy.rts_threshold = old_rts_threshold;
1464                         rdev->wiphy.coverage_class = old_coverage_class;
1465                 }
1466         }
1467
1468  bad_res:
1469         mutex_unlock(&rdev->mtx);
1470         if (netdev)
1471                 dev_put(netdev);
1472         return result;
1473 }
1474
1475
1476 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1477                               struct cfg80211_registered_device *rdev,
1478                               struct net_device *dev)
1479 {
1480         void *hdr;
1481
1482         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1483         if (!hdr)
1484                 return -1;
1485
1486         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1487         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1488         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1489         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1490
1491         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1492                     rdev->devlist_generation ^
1493                         (cfg80211_rdev_list_generation << 2));
1494
1495         return genlmsg_end(msg, hdr);
1496
1497  nla_put_failure:
1498         genlmsg_cancel(msg, hdr);
1499         return -EMSGSIZE;
1500 }
1501
1502 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1503 {
1504         int wp_idx = 0;
1505         int if_idx = 0;
1506         int wp_start = cb->args[0];
1507         int if_start = cb->args[1];
1508         struct cfg80211_registered_device *rdev;
1509         struct wireless_dev *wdev;
1510
1511         mutex_lock(&cfg80211_mutex);
1512         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1513                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1514                         continue;
1515                 if (wp_idx < wp_start) {
1516                         wp_idx++;
1517                         continue;
1518                 }
1519                 if_idx = 0;
1520
1521                 mutex_lock(&rdev->devlist_mtx);
1522                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1523                         if (if_idx < if_start) {
1524                                 if_idx++;
1525                                 continue;
1526                         }
1527                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1528                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1529                                                rdev, wdev->netdev) < 0) {
1530                                 mutex_unlock(&rdev->devlist_mtx);
1531                                 goto out;
1532                         }
1533                         if_idx++;
1534                 }
1535                 mutex_unlock(&rdev->devlist_mtx);
1536
1537                 wp_idx++;
1538         }
1539  out:
1540         mutex_unlock(&cfg80211_mutex);
1541
1542         cb->args[0] = wp_idx;
1543         cb->args[1] = if_idx;
1544
1545         return skb->len;
1546 }
1547
1548 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1549 {
1550         struct sk_buff *msg;
1551         struct cfg80211_registered_device *dev = info->user_ptr[0];
1552         struct net_device *netdev = info->user_ptr[1];
1553
1554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1555         if (!msg)
1556                 return -ENOMEM;
1557
1558         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1559                                dev, netdev) < 0) {
1560                 nlmsg_free(msg);
1561                 return -ENOBUFS;
1562         }
1563
1564         return genlmsg_reply(msg, info);
1565 }
1566
1567 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1568         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1569         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1570         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1571         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1572         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1573 };
1574
1575 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1576 {
1577         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1578         int flag;
1579
1580         *mntrflags = 0;
1581
1582         if (!nla)
1583                 return -EINVAL;
1584
1585         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1586                              nla, mntr_flags_policy))
1587                 return -EINVAL;
1588
1589         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1590                 if (flags[flag])
1591                         *mntrflags |= (1<<flag);
1592
1593         return 0;
1594 }
1595
1596 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1597                                struct net_device *netdev, u8 use_4addr,
1598                                enum nl80211_iftype iftype)
1599 {
1600         if (!use_4addr) {
1601                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1602                         return -EBUSY;
1603                 return 0;
1604         }
1605
1606         switch (iftype) {
1607         case NL80211_IFTYPE_AP_VLAN:
1608                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1609                         return 0;
1610                 break;
1611         case NL80211_IFTYPE_STATION:
1612                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1613                         return 0;
1614                 break;
1615         default:
1616                 break;
1617         }
1618
1619         return -EOPNOTSUPP;
1620 }
1621
1622 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1623 {
1624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1625         struct vif_params params;
1626         int err;
1627         enum nl80211_iftype otype, ntype;
1628         struct net_device *dev = info->user_ptr[1];
1629         u32 _flags, *flags = NULL;
1630         bool change = false;
1631
1632         memset(&params, 0, sizeof(params));
1633
1634         otype = ntype = dev->ieee80211_ptr->iftype;
1635
1636         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1637                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1638                 if (otype != ntype)
1639                         change = true;
1640                 if (ntype > NL80211_IFTYPE_MAX)
1641                         return -EINVAL;
1642         }
1643
1644         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1645                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1646
1647                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1648                         return -EINVAL;
1649                 if (netif_running(dev))
1650                         return -EBUSY;
1651
1652                 wdev_lock(wdev);
1653                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1654                              IEEE80211_MAX_MESH_ID_LEN);
1655                 wdev->mesh_id_up_len =
1656                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1657                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1658                        wdev->mesh_id_up_len);
1659                 wdev_unlock(wdev);
1660         }
1661
1662         if (info->attrs[NL80211_ATTR_4ADDR]) {
1663                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1664                 change = true;
1665                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1666                 if (err)
1667                         return err;
1668         } else {
1669                 params.use_4addr = -1;
1670         }
1671
1672         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1673                 if (ntype != NL80211_IFTYPE_MONITOR)
1674                         return -EINVAL;
1675                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1676                                           &_flags);
1677                 if (err)
1678                         return err;
1679
1680                 flags = &_flags;
1681                 change = true;
1682         }
1683
1684         if (change)
1685                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1686         else
1687                 err = 0;
1688
1689         if (!err && params.use_4addr != -1)
1690                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1691
1692         return err;
1693 }
1694
1695 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1696 {
1697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1698         struct vif_params params;
1699         struct net_device *dev;
1700         int err;
1701         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1702         u32 flags;
1703
1704         memset(&params, 0, sizeof(params));
1705
1706         if (!info->attrs[NL80211_ATTR_IFNAME])
1707                 return -EINVAL;
1708
1709         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1710                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1711                 if (type > NL80211_IFTYPE_MAX)
1712                         return -EINVAL;
1713         }
1714
1715         if (!rdev->ops->add_virtual_intf ||
1716             !(rdev->wiphy.interface_modes & (1 << type)))
1717                 return -EOPNOTSUPP;
1718
1719         if (info->attrs[NL80211_ATTR_4ADDR]) {
1720                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1721                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1722                 if (err)
1723                         return err;
1724         }
1725
1726         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1727                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1728                                   &flags);
1729         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1730                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1731                 type, err ? NULL : &flags, &params);
1732         if (IS_ERR(dev))
1733                 return PTR_ERR(dev);
1734
1735         if (type == NL80211_IFTYPE_MESH_POINT &&
1736             info->attrs[NL80211_ATTR_MESH_ID]) {
1737                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1738
1739                 wdev_lock(wdev);
1740                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1741                              IEEE80211_MAX_MESH_ID_LEN);
1742                 wdev->mesh_id_up_len =
1743                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1744                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1745                        wdev->mesh_id_up_len);
1746                 wdev_unlock(wdev);
1747         }
1748
1749         return 0;
1750 }
1751
1752 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1753 {
1754         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1755         struct net_device *dev = info->user_ptr[1];
1756
1757         if (!rdev->ops->del_virtual_intf)
1758                 return -EOPNOTSUPP;
1759
1760         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1761 }
1762
1763 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
1764 {
1765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1766         struct net_device *dev = info->user_ptr[1];
1767         u16 noack_map;
1768
1769         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
1770                 return -EINVAL;
1771
1772         if (!rdev->ops->set_noack_map)
1773                 return -EOPNOTSUPP;
1774
1775         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
1776
1777         return rdev->ops->set_noack_map(&rdev->wiphy, dev, noack_map);
1778 }
1779
1780 struct get_key_cookie {
1781         struct sk_buff *msg;
1782         int error;
1783         int idx;
1784 };
1785
1786 static void get_key_callback(void *c, struct key_params *params)
1787 {
1788         struct nlattr *key;
1789         struct get_key_cookie *cookie = c;
1790
1791         if (params->key)
1792                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1793                         params->key_len, params->key);
1794
1795         if (params->seq)
1796                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1797                         params->seq_len, params->seq);
1798
1799         if (params->cipher)
1800                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1801                             params->cipher);
1802
1803         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1804         if (!key)
1805                 goto nla_put_failure;
1806
1807         if (params->key)
1808                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1809                         params->key_len, params->key);
1810
1811         if (params->seq)
1812                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1813                         params->seq_len, params->seq);
1814
1815         if (params->cipher)
1816                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1817                             params->cipher);
1818
1819         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1820
1821         nla_nest_end(cookie->msg, key);
1822
1823         return;
1824  nla_put_failure:
1825         cookie->error = 1;
1826 }
1827
1828 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1829 {
1830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1831         int err;
1832         struct net_device *dev = info->user_ptr[1];
1833         u8 key_idx = 0;
1834         const u8 *mac_addr = NULL;
1835         bool pairwise;
1836         struct get_key_cookie cookie = {
1837                 .error = 0,
1838         };
1839         void *hdr;
1840         struct sk_buff *msg;
1841
1842         if (info->attrs[NL80211_ATTR_KEY_IDX])
1843                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1844
1845         if (key_idx > 5)
1846                 return -EINVAL;
1847
1848         if (info->attrs[NL80211_ATTR_MAC])
1849                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1850
1851         pairwise = !!mac_addr;
1852         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1853                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1854                 if (kt >= NUM_NL80211_KEYTYPES)
1855                         return -EINVAL;
1856                 if (kt != NL80211_KEYTYPE_GROUP &&
1857                     kt != NL80211_KEYTYPE_PAIRWISE)
1858                         return -EINVAL;
1859                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1860         }
1861
1862         if (!rdev->ops->get_key)
1863                 return -EOPNOTSUPP;
1864
1865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1866         if (!msg)
1867                 return -ENOMEM;
1868
1869         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1870                              NL80211_CMD_NEW_KEY);
1871         if (IS_ERR(hdr))
1872                 return PTR_ERR(hdr);
1873
1874         cookie.msg = msg;
1875         cookie.idx = key_idx;
1876
1877         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1878         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1879         if (mac_addr)
1880                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1881
1882         if (pairwise && mac_addr &&
1883             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1884                 return -ENOENT;
1885
1886         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1887                                  mac_addr, &cookie, get_key_callback);
1888
1889         if (err)
1890                 goto free_msg;
1891
1892         if (cookie.error)
1893                 goto nla_put_failure;
1894
1895         genlmsg_end(msg, hdr);
1896         return genlmsg_reply(msg, info);
1897
1898  nla_put_failure:
1899         err = -ENOBUFS;
1900  free_msg:
1901         nlmsg_free(msg);
1902         return err;
1903 }
1904
1905 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1908         struct key_parse key;
1909         int err;
1910         struct net_device *dev = info->user_ptr[1];
1911
1912         err = nl80211_parse_key(info, &key);
1913         if (err)
1914                 return err;
1915
1916         if (key.idx < 0)
1917                 return -EINVAL;
1918
1919         /* only support setting default key */
1920         if (!key.def && !key.defmgmt)
1921                 return -EINVAL;
1922
1923         wdev_lock(dev->ieee80211_ptr);
1924
1925         if (key.def) {
1926                 if (!rdev->ops->set_default_key) {
1927                         err = -EOPNOTSUPP;
1928                         goto out;
1929                 }
1930
1931                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1932                 if (err)
1933                         goto out;
1934
1935                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1936                                                  key.def_uni, key.def_multi);
1937
1938                 if (err)
1939                         goto out;
1940
1941 #ifdef CONFIG_CFG80211_WEXT
1942                 dev->ieee80211_ptr->wext.default_key = key.idx;
1943 #endif
1944         } else {
1945                 if (key.def_uni || !key.def_multi) {
1946                         err = -EINVAL;
1947                         goto out;
1948                 }
1949
1950                 if (!rdev->ops->set_default_mgmt_key) {
1951                         err = -EOPNOTSUPP;
1952                         goto out;
1953                 }
1954
1955                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1956                 if (err)
1957                         goto out;
1958
1959                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1960                                                       dev, key.idx);
1961                 if (err)
1962                         goto out;
1963
1964 #ifdef CONFIG_CFG80211_WEXT
1965                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1966 #endif
1967         }
1968
1969  out:
1970         wdev_unlock(dev->ieee80211_ptr);
1971
1972         return err;
1973 }
1974
1975 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1976 {
1977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1978         int err;
1979         struct net_device *dev = info->user_ptr[1];
1980         struct key_parse key;
1981         const u8 *mac_addr = NULL;
1982
1983         err = nl80211_parse_key(info, &key);
1984         if (err)
1985                 return err;
1986
1987         if (!key.p.key)
1988                 return -EINVAL;
1989
1990         if (info->attrs[NL80211_ATTR_MAC])
1991                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1992
1993         if (key.type == -1) {
1994                 if (mac_addr)
1995                         key.type = NL80211_KEYTYPE_PAIRWISE;
1996                 else
1997                         key.type = NL80211_KEYTYPE_GROUP;
1998         }
1999
2000         /* for now */
2001         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2002             key.type != NL80211_KEYTYPE_GROUP)
2003                 return -EINVAL;
2004
2005         if (!rdev->ops->add_key)
2006                 return -EOPNOTSUPP;
2007
2008         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2009                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2010                                            mac_addr))
2011                 return -EINVAL;
2012
2013         wdev_lock(dev->ieee80211_ptr);
2014         err = nl80211_key_allowed(dev->ieee80211_ptr);
2015         if (!err)
2016                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
2017                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2018                                          mac_addr, &key.p);
2019         wdev_unlock(dev->ieee80211_ptr);
2020
2021         return err;
2022 }
2023
2024 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2025 {
2026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2027         int err;
2028         struct net_device *dev = info->user_ptr[1];
2029         u8 *mac_addr = NULL;
2030         struct key_parse key;
2031
2032         err = nl80211_parse_key(info, &key);
2033         if (err)
2034                 return err;
2035
2036         if (info->attrs[NL80211_ATTR_MAC])
2037                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2038
2039         if (key.type == -1) {
2040                 if (mac_addr)
2041                         key.type = NL80211_KEYTYPE_PAIRWISE;
2042                 else
2043                         key.type = NL80211_KEYTYPE_GROUP;
2044         }
2045
2046         /* for now */
2047         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2048             key.type != NL80211_KEYTYPE_GROUP)
2049                 return -EINVAL;
2050
2051         if (!rdev->ops->del_key)
2052                 return -EOPNOTSUPP;
2053
2054         wdev_lock(dev->ieee80211_ptr);
2055         err = nl80211_key_allowed(dev->ieee80211_ptr);
2056
2057         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2058             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2059                 err = -ENOENT;
2060
2061         if (!err)
2062                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2063                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2064                                          mac_addr);
2065
2066 #ifdef CONFIG_CFG80211_WEXT
2067         if (!err) {
2068                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2069                         dev->ieee80211_ptr->wext.default_key = -1;
2070                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2071                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2072         }
2073 #endif
2074         wdev_unlock(dev->ieee80211_ptr);
2075
2076         return err;
2077 }
2078
2079 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
2080 {
2081         int (*call)(struct wiphy *wiphy, struct net_device *dev,
2082                     struct beacon_parameters *info);
2083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2084         struct net_device *dev = info->user_ptr[1];
2085         struct wireless_dev *wdev = dev->ieee80211_ptr;
2086         struct beacon_parameters params;
2087         int haveinfo = 0, err;
2088
2089         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2090             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2091             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2092             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2093                 return -EINVAL;
2094
2095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2097                 return -EOPNOTSUPP;
2098
2099         memset(&params, 0, sizeof(params));
2100
2101         switch (info->genlhdr->cmd) {
2102         case NL80211_CMD_NEW_BEACON:
2103                 /* these are required for NEW_BEACON */
2104                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2105                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2106                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2107                         return -EINVAL;
2108
2109                 params.interval =
2110                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2111                 params.dtim_period =
2112                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2113
2114                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2115                 if (err)
2116                         return err;
2117
2118                 /*
2119                  * In theory, some of these attributes could be required for
2120                  * NEW_BEACON, but since they were not used when the command was
2121                  * originally added, keep them optional for old user space
2122                  * programs to work with drivers that do not need the additional
2123                  * information.
2124                  */
2125                 if (info->attrs[NL80211_ATTR_SSID]) {
2126                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2127                         params.ssid_len =
2128                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2129                         if (params.ssid_len == 0 ||
2130                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2131                                 return -EINVAL;
2132                 }
2133
2134                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2135                         params.hidden_ssid = nla_get_u32(
2136                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2137                         if (params.hidden_ssid !=
2138                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2139                             params.hidden_ssid !=
2140                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2141                             params.hidden_ssid !=
2142                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2143                                 return -EINVAL;
2144                 }
2145
2146                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2147
2148                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2149                         params.auth_type = nla_get_u32(
2150                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2151                         if (!nl80211_valid_auth_type(params.auth_type))
2152                                 return -EINVAL;
2153                 } else
2154                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2155
2156                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2157                                               NL80211_MAX_NR_CIPHER_SUITES);
2158                 if (err)
2159                         return err;
2160
2161                 call = rdev->ops->add_beacon;
2162                 break;
2163         case NL80211_CMD_SET_BEACON:
2164                 call = rdev->ops->set_beacon;
2165                 break;
2166         default:
2167                 WARN_ON(1);
2168                 return -EOPNOTSUPP;
2169         }
2170
2171         if (!call)
2172                 return -EOPNOTSUPP;
2173
2174         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2175                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2176                 params.head_len =
2177                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2178                 haveinfo = 1;
2179         }
2180
2181         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2182                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2183                 params.tail_len =
2184                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2185                 haveinfo = 1;
2186         }
2187
2188         if (!haveinfo)
2189                 return -EINVAL;
2190
2191         if (info->attrs[NL80211_ATTR_IE]) {
2192                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2193                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2194         }
2195
2196         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2197                 params.proberesp_ies =
2198                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2199                 params.proberesp_ies_len =
2200                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2201         }
2202
2203         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2204                 params.assocresp_ies =
2205                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2206                 params.assocresp_ies_len =
2207                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2208         }
2209
2210         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2211                 params.probe_resp =
2212                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2213                 params.probe_resp_len =
2214                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2215         }
2216
2217         err = call(&rdev->wiphy, dev, &params);
2218         if (!err && params.interval)
2219                 wdev->beacon_interval = params.interval;
2220         return err;
2221 }
2222
2223 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2224 {
2225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2226         struct net_device *dev = info->user_ptr[1];
2227         struct wireless_dev *wdev = dev->ieee80211_ptr;
2228         int err;
2229
2230         if (!rdev->ops->del_beacon)
2231                 return -EOPNOTSUPP;
2232
2233         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2234             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2235                 return -EOPNOTSUPP;
2236
2237         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2238         if (!err)
2239                 wdev->beacon_interval = 0;
2240         return err;
2241 }
2242
2243 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2244         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2245         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2246         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2247         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2248         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2249         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2250 };
2251
2252 static int parse_station_flags(struct genl_info *info,
2253                                struct station_parameters *params)
2254 {
2255         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2256         struct nlattr *nla;
2257         int flag;
2258
2259         /*
2260          * Try parsing the new attribute first so userspace
2261          * can specify both for older kernels.
2262          */
2263         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2264         if (nla) {
2265                 struct nl80211_sta_flag_update *sta_flags;
2266
2267                 sta_flags = nla_data(nla);
2268                 params->sta_flags_mask = sta_flags->mask;
2269                 params->sta_flags_set = sta_flags->set;
2270                 if ((params->sta_flags_mask |
2271                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2272                         return -EINVAL;
2273                 return 0;
2274         }
2275
2276         /* if present, parse the old attribute */
2277
2278         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2279         if (!nla)
2280                 return 0;
2281
2282         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2283                              nla, sta_flags_policy))
2284                 return -EINVAL;
2285
2286         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2287         params->sta_flags_mask &= ~1;
2288
2289         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2290                 if (flags[flag])
2291                         params->sta_flags_set |= (1<<flag);
2292
2293         return 0;
2294 }
2295
2296 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2297                                  int attr)
2298 {
2299         struct nlattr *rate;
2300         u16 bitrate;
2301
2302         rate = nla_nest_start(msg, attr);
2303         if (!rate)
2304                 goto nla_put_failure;
2305
2306         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2307         bitrate = cfg80211_calculate_bitrate(info);
2308         if (bitrate > 0)
2309                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2310
2311         if (info->flags & RATE_INFO_FLAGS_MCS)
2312                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2313         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2314                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2315         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2316                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2317
2318         nla_nest_end(msg, rate);
2319         return true;
2320
2321 nla_put_failure:
2322         return false;
2323 }
2324
2325 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2326                                 int flags, struct net_device *dev,
2327                                 const u8 *mac_addr, struct station_info *sinfo)
2328 {
2329         void *hdr;
2330         struct nlattr *sinfoattr, *bss_param;
2331
2332         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2333         if (!hdr)
2334                 return -1;
2335
2336         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2337         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2338
2339         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2340
2341         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2342         if (!sinfoattr)
2343                 goto nla_put_failure;
2344         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2345                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2346                             sinfo->connected_time);
2347         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2348                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2349                             sinfo->inactive_time);
2350         if (sinfo->filled & STATION_INFO_RX_BYTES)
2351                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2352                             sinfo->rx_bytes);
2353         if (sinfo->filled & STATION_INFO_TX_BYTES)
2354                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2355                             sinfo->tx_bytes);
2356         if (sinfo->filled & STATION_INFO_LLID)
2357                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2358                             sinfo->llid);
2359         if (sinfo->filled & STATION_INFO_PLID)
2360                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2361                             sinfo->plid);
2362         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2363                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2364                             sinfo->plink_state);
2365         if (sinfo->filled & STATION_INFO_SIGNAL)
2366                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2367                            sinfo->signal);
2368         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2369                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2370                            sinfo->signal_avg);
2371         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2372                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2373                                           NL80211_STA_INFO_TX_BITRATE))
2374                         goto nla_put_failure;
2375         }
2376         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2377                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2378                                           NL80211_STA_INFO_RX_BITRATE))
2379                         goto nla_put_failure;
2380         }
2381         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2382                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2383                             sinfo->rx_packets);
2384         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2385                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2386                             sinfo->tx_packets);
2387         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2388                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2389                             sinfo->tx_retries);
2390         if (sinfo->filled & STATION_INFO_TX_FAILED)
2391                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2392                             sinfo->tx_failed);
2393         if (sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT)
2394                 NLA_PUT_U32(msg, NL80211_STA_INFO_BEACON_LOSS,
2395                             sinfo->beacon_loss_count);
2396         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2397                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2398                 if (!bss_param)
2399                         goto nla_put_failure;
2400
2401                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2402                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2403                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2404                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2405                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2406                         NLA_PUT_FLAG(msg,
2407                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2408                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2409                            sinfo->bss_param.dtim_period);
2410                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2411                             sinfo->bss_param.beacon_interval);
2412
2413                 nla_nest_end(msg, bss_param);
2414         }
2415         if (sinfo->filled & STATION_INFO_STA_FLAGS)
2416                 NLA_PUT(msg, NL80211_STA_INFO_STA_FLAGS,
2417                         sizeof(struct nl80211_sta_flag_update),
2418                         &sinfo->sta_flags);
2419         nla_nest_end(msg, sinfoattr);
2420
2421         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2422                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2423                         sinfo->assoc_req_ies);
2424
2425         return genlmsg_end(msg, hdr);
2426
2427  nla_put_failure:
2428         genlmsg_cancel(msg, hdr);
2429         return -EMSGSIZE;
2430 }
2431
2432 static int nl80211_dump_station(struct sk_buff *skb,
2433                                 struct netlink_callback *cb)
2434 {
2435         struct station_info sinfo;
2436         struct cfg80211_registered_device *dev;
2437         struct net_device *netdev;
2438         u8 mac_addr[ETH_ALEN];
2439         int sta_idx = cb->args[1];
2440         int err;
2441
2442         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2443         if (err)
2444                 return err;
2445
2446         if (!dev->ops->dump_station) {
2447                 err = -EOPNOTSUPP;
2448                 goto out_err;
2449         }
2450
2451         while (1) {
2452                 memset(&sinfo, 0, sizeof(sinfo));
2453                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2454                                              mac_addr, &sinfo);
2455                 if (err == -ENOENT)
2456                         break;
2457                 if (err)
2458                         goto out_err;
2459
2460                 if (nl80211_send_station(skb,
2461                                 NETLINK_CB(cb->skb).pid,
2462                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2463                                 netdev, mac_addr,
2464                                 &sinfo) < 0)
2465                         goto out;
2466
2467                 sta_idx++;
2468         }
2469
2470
2471  out:
2472         cb->args[1] = sta_idx;
2473         err = skb->len;
2474  out_err:
2475         nl80211_finish_netdev_dump(dev);
2476
2477         return err;
2478 }
2479
2480 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2481 {
2482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2483         struct net_device *dev = info->user_ptr[1];
2484         struct station_info sinfo;
2485         struct sk_buff *msg;
2486         u8 *mac_addr = NULL;
2487         int err;
2488
2489         memset(&sinfo, 0, sizeof(sinfo));
2490
2491         if (!info->attrs[NL80211_ATTR_MAC])
2492                 return -EINVAL;
2493
2494         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2495
2496         if (!rdev->ops->get_station)
2497                 return -EOPNOTSUPP;
2498
2499         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2500         if (err)
2501                 return err;
2502
2503         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2504         if (!msg)
2505                 return -ENOMEM;
2506
2507         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2508                                  dev, mac_addr, &sinfo) < 0) {
2509                 nlmsg_free(msg);
2510                 return -ENOBUFS;
2511         }
2512
2513         return genlmsg_reply(msg, info);
2514 }
2515
2516 /*
2517  * Get vlan interface making sure it is running and on the right wiphy.
2518  */
2519 static struct net_device *get_vlan(struct genl_info *info,
2520                                    struct cfg80211_registered_device *rdev)
2521 {
2522         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2523         struct net_device *v;
2524         int ret;
2525
2526         if (!vlanattr)
2527                 return NULL;
2528
2529         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
2530         if (!v)
2531                 return ERR_PTR(-ENODEV);
2532
2533         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
2534                 ret = -EINVAL;
2535                 goto error;
2536         }
2537
2538         if (!netif_running(v)) {
2539                 ret = -ENETDOWN;
2540                 goto error;
2541         }
2542
2543         return v;
2544  error:
2545         dev_put(v);
2546         return ERR_PTR(ret);
2547 }
2548
2549 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2550 {
2551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2552         int err;
2553         struct net_device *dev = info->user_ptr[1];
2554         struct station_parameters params;
2555         u8 *mac_addr = NULL;
2556
2557         memset(&params, 0, sizeof(params));
2558
2559         params.listen_interval = -1;
2560         params.plink_state = -1;
2561
2562         if (info->attrs[NL80211_ATTR_STA_AID])
2563                 return -EINVAL;
2564
2565         if (!info->attrs[NL80211_ATTR_MAC])
2566                 return -EINVAL;
2567
2568         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2569
2570         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2571                 params.supported_rates =
2572                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2573                 params.supported_rates_len =
2574                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2575         }
2576
2577         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2578                 params.listen_interval =
2579                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2580
2581         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2582                 params.ht_capa =
2583                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2584
2585         if (!rdev->ops->change_station)
2586                 return -EOPNOTSUPP;
2587
2588         if (parse_station_flags(info, &params))
2589                 return -EINVAL;
2590
2591         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2592                 params.plink_action =
2593                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2594
2595         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2596                 params.plink_state =
2597                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2598
2599         switch (dev->ieee80211_ptr->iftype) {
2600         case NL80211_IFTYPE_AP:
2601         case NL80211_IFTYPE_AP_VLAN:
2602         case NL80211_IFTYPE_P2P_GO:
2603                 /* disallow mesh-specific things */
2604                 if (params.plink_action)
2605                         return -EINVAL;
2606
2607                 /* TDLS can't be set, ... */
2608                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2609                         return -EINVAL;
2610                 /*
2611                  * ... but don't bother the driver with it. This works around
2612                  * a hostapd/wpa_supplicant issue -- it always includes the
2613                  * TLDS_PEER flag in the mask even for AP mode.
2614                  */
2615                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2616
2617                 /* accept only the listed bits */
2618                 if (params.sta_flags_mask &
2619                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
2620                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2621                                   BIT(NL80211_STA_FLAG_WME) |
2622                                   BIT(NL80211_STA_FLAG_MFP)))
2623                         return -EINVAL;
2624
2625                 /* must be last in here for error handling */
2626                 params.vlan = get_vlan(info, rdev);
2627                 if (IS_ERR(params.vlan))
2628                         return PTR_ERR(params.vlan);
2629                 break;
2630         case NL80211_IFTYPE_P2P_CLIENT:
2631         case NL80211_IFTYPE_STATION:
2632                 /* disallow things sta doesn't support */
2633                 if (params.plink_action)
2634                         return -EINVAL;
2635                 if (params.ht_capa)
2636                         return -EINVAL;
2637                 if (params.listen_interval >= 0)
2638                         return -EINVAL;
2639                 /*
2640                  * Don't allow userspace to change the TDLS_PEER flag,
2641                  * but silently ignore attempts to change it since we
2642                  * don't have state here to verify that it doesn't try
2643                  * to change the flag.
2644                  */
2645                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2646
2647                 /* reject any changes other than AUTHORIZED */
2648                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2649                         return -EINVAL;
2650                 break;
2651         case NL80211_IFTYPE_MESH_POINT:
2652                 /* disallow things mesh doesn't support */
2653                 if (params.vlan)
2654                         return -EINVAL;
2655                 if (params.ht_capa)
2656                         return -EINVAL;
2657                 if (params.listen_interval >= 0)
2658                         return -EINVAL;
2659                 /*
2660                  * No special handling for TDLS here -- the userspace
2661                  * mesh code doesn't have this bug.
2662                  */
2663                 if (params.sta_flags_mask &
2664                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2665                                   BIT(NL80211_STA_FLAG_MFP) |
2666                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2667                         return -EINVAL;
2668                 break;
2669         default:
2670                 return -EOPNOTSUPP;
2671         }
2672
2673         /* be aware of params.vlan when changing code here */
2674
2675         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2676
2677         if (params.vlan)
2678                 dev_put(params.vlan);
2679
2680         return err;
2681 }
2682
2683 static struct nla_policy
2684 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2685         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2686         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2687 };
2688
2689 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2690 {
2691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2692         int err;
2693         struct net_device *dev = info->user_ptr[1];
2694         struct station_parameters params;
2695         u8 *mac_addr = NULL;
2696
2697         memset(&params, 0, sizeof(params));
2698
2699         if (!info->attrs[NL80211_ATTR_MAC])
2700                 return -EINVAL;
2701
2702         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2703                 return -EINVAL;
2704
2705         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2706                 return -EINVAL;
2707
2708         if (!info->attrs[NL80211_ATTR_STA_AID])
2709                 return -EINVAL;
2710
2711         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2712         params.supported_rates =
2713                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2714         params.supported_rates_len =
2715                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2716         params.listen_interval =
2717                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2718
2719         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2720         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2721                 return -EINVAL;
2722
2723         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2724                 params.ht_capa =
2725                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2726
2727         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2728                 params.plink_action =
2729                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2730
2731         if (!rdev->ops->add_station)
2732                 return -EOPNOTSUPP;
2733
2734         if (parse_station_flags(info, &params))
2735                 return -EINVAL;
2736
2737         switch (dev->ieee80211_ptr->iftype) {
2738         case NL80211_IFTYPE_AP:
2739         case NL80211_IFTYPE_AP_VLAN:
2740         case NL80211_IFTYPE_P2P_GO:
2741                 /* parse WME attributes if sta is WME capable */
2742                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2743                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
2744                     info->attrs[NL80211_ATTR_STA_WME]) {
2745                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2746                         struct nlattr *nla;
2747
2748                         nla = info->attrs[NL80211_ATTR_STA_WME];
2749                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2750                                                nl80211_sta_wme_policy);
2751                         if (err)
2752                                 return err;
2753
2754                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2755                                 params.uapsd_queues =
2756                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2757                         if (params.uapsd_queues &
2758                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
2759                                 return -EINVAL;
2760
2761                         if (tb[NL80211_STA_WME_MAX_SP])
2762                                 params.max_sp =
2763                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2764
2765                         if (params.max_sp &
2766                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
2767                                 return -EINVAL;
2768
2769                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
2770                 }
2771                 /* TDLS peers cannot be added */
2772                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2773                         return -EINVAL;
2774                 /* but don't bother the driver with it */
2775                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2776
2777                 /* must be last in here for error handling */
2778                 params.vlan = get_vlan(info, rdev);
2779                 if (IS_ERR(params.vlan))
2780                         return PTR_ERR(params.vlan);
2781                 break;
2782         case NL80211_IFTYPE_MESH_POINT:
2783                 /* TDLS peers cannot be added */
2784                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2785                         return -EINVAL;
2786                 break;
2787         case NL80211_IFTYPE_STATION:
2788                 /* Only TDLS peers can be added */
2789                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
2790                         return -EINVAL;
2791                 /* Can only add if TDLS ... */
2792                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
2793                         return -EOPNOTSUPP;
2794                 /* ... with external setup is supported */
2795                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
2796                         return -EOPNOTSUPP;
2797                 break;
2798         default:
2799                 return -EOPNOTSUPP;
2800         }
2801
2802         /* be aware of params.vlan when changing code here */
2803
2804         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2805
2806         if (params.vlan)
2807                 dev_put(params.vlan);
2808         return err;
2809 }
2810
2811 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2812 {
2813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2814         struct net_device *dev = info->user_ptr[1];
2815         u8 *mac_addr = NULL;
2816
2817         if (info->attrs[NL80211_ATTR_MAC])
2818                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2819
2820         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2821             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2822             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2823             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2824                 return -EINVAL;
2825
2826         if (!rdev->ops->del_station)
2827                 return -EOPNOTSUPP;
2828
2829         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2830 }
2831
2832 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2833                                 int flags, struct net_device *dev,
2834                                 u8 *dst, u8 *next_hop,
2835                                 struct mpath_info *pinfo)
2836 {
2837         void *hdr;
2838         struct nlattr *pinfoattr;
2839
2840         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2841         if (!hdr)
2842                 return -1;
2843
2844         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2845         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2846         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2847
2848         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2849
2850         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2851         if (!pinfoattr)
2852                 goto nla_put_failure;
2853         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2854                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2855                             pinfo->frame_qlen);
2856         if (pinfo->filled & MPATH_INFO_SN)
2857                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2858                             pinfo->sn);
2859         if (pinfo->filled & MPATH_INFO_METRIC)
2860                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2861                             pinfo->metric);
2862         if (pinfo->filled & MPATH_INFO_EXPTIME)
2863                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2864                             pinfo->exptime);
2865         if (pinfo->filled & MPATH_INFO_FLAGS)
2866                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2867                             pinfo->flags);
2868         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2869                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2870                             pinfo->discovery_timeout);
2871         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2872                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2873                             pinfo->discovery_retries);
2874
2875         nla_nest_end(msg, pinfoattr);
2876
2877         return genlmsg_end(msg, hdr);
2878
2879  nla_put_failure:
2880         genlmsg_cancel(msg, hdr);
2881         return -EMSGSIZE;
2882 }
2883
2884 static int nl80211_dump_mpath(struct sk_buff *skb,
2885                               struct netlink_callback *cb)
2886 {
2887         struct mpath_info pinfo;
2888         struct cfg80211_registered_device *dev;
2889         struct net_device *netdev;
2890         u8 dst[ETH_ALEN];
2891         u8 next_hop[ETH_ALEN];
2892         int path_idx = cb->args[1];
2893         int err;
2894
2895         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2896         if (err)
2897                 return err;
2898
2899         if (!dev->ops->dump_mpath) {
2900                 err = -EOPNOTSUPP;
2901                 goto out_err;
2902         }
2903
2904         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2905                 err = -EOPNOTSUPP;
2906                 goto out_err;
2907         }
2908
2909         while (1) {
2910                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2911                                            dst, next_hop, &pinfo);
2912                 if (err == -ENOENT)
2913                         break;
2914                 if (err)
2915                         goto out_err;
2916
2917                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2918                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2919                                        netdev, dst, next_hop,
2920                                        &pinfo) < 0)
2921                         goto out;
2922
2923                 path_idx++;
2924         }
2925
2926
2927  out:
2928         cb->args[1] = path_idx;
2929         err = skb->len;
2930  out_err:
2931         nl80211_finish_netdev_dump(dev);
2932         return err;
2933 }
2934
2935 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2936 {
2937         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2938         int err;
2939         struct net_device *dev = info->user_ptr[1];
2940         struct mpath_info pinfo;
2941         struct sk_buff *msg;
2942         u8 *dst = NULL;
2943         u8 next_hop[ETH_ALEN];
2944
2945         memset(&pinfo, 0, sizeof(pinfo));
2946
2947         if (!info->attrs[NL80211_ATTR_MAC])
2948                 return -EINVAL;
2949
2950         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2951
2952         if (!rdev->ops->get_mpath)
2953                 return -EOPNOTSUPP;
2954
2955         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2956                 return -EOPNOTSUPP;
2957
2958         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2959         if (err)
2960                 return err;
2961
2962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2963         if (!msg)
2964                 return -ENOMEM;
2965
2966         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2967                                  dev, dst, next_hop, &pinfo) < 0) {
2968                 nlmsg_free(msg);
2969                 return -ENOBUFS;
2970         }
2971
2972         return genlmsg_reply(msg, info);
2973 }
2974
2975 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2976 {
2977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2978         struct net_device *dev = info->user_ptr[1];
2979         u8 *dst = NULL;
2980         u8 *next_hop = NULL;
2981
2982         if (!info->attrs[NL80211_ATTR_MAC])
2983                 return -EINVAL;
2984
2985         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2986                 return -EINVAL;
2987
2988         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2989         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2990
2991         if (!rdev->ops->change_mpath)
2992                 return -EOPNOTSUPP;
2993
2994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2995                 return -EOPNOTSUPP;
2996
2997         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2998 }
2999
3000 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3001 {
3002         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3003         struct net_device *dev = info->user_ptr[1];
3004         u8 *dst = NULL;
3005         u8 *next_hop = NULL;
3006
3007         if (!info->attrs[NL80211_ATTR_MAC])
3008                 return -EINVAL;
3009
3010         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3011                 return -EINVAL;
3012
3013         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3014         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3015
3016         if (!rdev->ops->add_mpath)
3017                 return -EOPNOTSUPP;
3018
3019         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3020                 return -EOPNOTSUPP;
3021
3022         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
3023 }
3024
3025 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3026 {
3027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3028         struct net_device *dev = info->user_ptr[1];
3029         u8 *dst = NULL;
3030
3031         if (info->attrs[NL80211_ATTR_MAC])
3032                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3033
3034         if (!rdev->ops->del_mpath)
3035                 return -EOPNOTSUPP;
3036
3037         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
3038 }
3039
3040 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3041 {
3042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3043         struct net_device *dev = info->user_ptr[1];
3044         struct bss_parameters params;
3045
3046         memset(&params, 0, sizeof(params));
3047         /* default to not changing parameters */
3048         params.use_cts_prot = -1;
3049         params.use_short_preamble = -1;
3050         params.use_short_slot_time = -1;
3051         params.ap_isolate = -1;
3052         params.ht_opmode = -1;
3053
3054         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3055                 params.use_cts_prot =
3056                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3057         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3058                 params.use_short_preamble =
3059                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3060         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3061                 params.use_short_slot_time =
3062                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3063         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3064                 params.basic_rates =
3065                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3066                 params.basic_rates_len =
3067                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3068         }
3069         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3070                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3071         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3072                 params.ht_opmode =
3073                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3074
3075         if (!rdev->ops->change_bss)
3076                 return -EOPNOTSUPP;
3077
3078         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3079             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3080                 return -EOPNOTSUPP;
3081
3082         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
3083 }
3084
3085 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3086         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3087         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3088         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3089         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3090         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3091         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3092 };
3093
3094 static int parse_reg_rule(struct nlattr *tb[],
3095         struct ieee80211_reg_rule *reg_rule)
3096 {
3097         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3098         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3099
3100         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3101                 return -EINVAL;
3102         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3103                 return -EINVAL;
3104         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3105                 return -EINVAL;
3106         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3107                 return -EINVAL;
3108         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3109                 return -EINVAL;
3110
3111         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3112
3113         freq_range->start_freq_khz =
3114                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3115         freq_range->end_freq_khz =
3116                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3117         freq_range->max_bandwidth_khz =
3118                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3119
3120         power_rule->max_eirp =
3121                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3122
3123         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3124                 power_rule->max_antenna_gain =
3125                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3126
3127         return 0;
3128 }
3129
3130 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3131 {
3132         int r;
3133         char *data = NULL;
3134
3135         /*
3136          * You should only get this when cfg80211 hasn't yet initialized
3137          * completely when built-in to the kernel right between the time
3138          * window between nl80211_init() and regulatory_init(), if that is
3139          * even possible.
3140          */
3141         mutex_lock(&cfg80211_mutex);
3142         if (unlikely(!cfg80211_regdomain)) {
3143                 mutex_unlock(&cfg80211_mutex);
3144                 return -EINPROGRESS;
3145         }
3146         mutex_unlock(&cfg80211_mutex);
3147
3148         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3149                 return -EINVAL;
3150
3151         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3152
3153         r = regulatory_hint_user(data);
3154
3155         return r;
3156 }
3157
3158 static int nl80211_get_mesh_config(struct sk_buff *skb,
3159                                    struct genl_info *info)
3160 {
3161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3162         struct net_device *dev = info->user_ptr[1];
3163         struct wireless_dev *wdev = dev->ieee80211_ptr;
3164         struct mesh_config cur_params;
3165         int err = 0;
3166         void *hdr;
3167         struct nlattr *pinfoattr;
3168         struct sk_buff *msg;
3169
3170         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3171                 return -EOPNOTSUPP;
3172
3173         if (!rdev->ops->get_mesh_config)
3174                 return -EOPNOTSUPP;
3175
3176         wdev_lock(wdev);
3177         /* If not connected, get default parameters */
3178         if (!wdev->mesh_id_len)
3179                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3180         else
3181                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3182                                                  &cur_params);
3183         wdev_unlock(wdev);
3184
3185         if (err)
3186                 return err;
3187
3188         /* Draw up a netlink message to send back */
3189         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3190         if (!msg)
3191                 return -ENOMEM;
3192         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3193                              NL80211_CMD_GET_MESH_CONFIG);
3194         if (!hdr)
3195                 goto out;
3196         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3197         if (!pinfoattr)
3198                 goto nla_put_failure;
3199         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3200         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3201                         cur_params.dot11MeshRetryTimeout);
3202         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3203                         cur_params.dot11MeshConfirmTimeout);
3204         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3205                         cur_params.dot11MeshHoldingTimeout);
3206         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3207                         cur_params.dot11MeshMaxPeerLinks);
3208         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3209                         cur_params.dot11MeshMaxRetries);
3210         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3211                         cur_params.dot11MeshTTL);
3212         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3213                         cur_params.element_ttl);
3214         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3215                         cur_params.auto_open_plinks);
3216         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3217                         cur_params.dot11MeshHWMPmaxPREQretries);
3218         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3219                         cur_params.path_refresh_time);
3220         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3221                         cur_params.min_discovery_timeout);
3222         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3223                         cur_params.dot11MeshHWMPactivePathTimeout);
3224         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3225                         cur_params.dot11MeshHWMPpreqMinInterval);
3226         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3227                         cur_params.dot11MeshHWMPperrMinInterval);
3228         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3229                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3230         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3231                         cur_params.dot11MeshHWMPRootMode);
3232         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3233                         cur_params.dot11MeshHWMPRannInterval);
3234         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3235                         cur_params.dot11MeshGateAnnouncementProtocol);
3236         nla_nest_end(msg, pinfoattr);
3237         genlmsg_end(msg, hdr);
3238         return genlmsg_reply(msg, info);
3239
3240  nla_put_failure:
3241         genlmsg_cancel(msg, hdr);
3242  out:
3243         nlmsg_free(msg);
3244         return -ENOBUFS;
3245 }
3246
3247 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3248         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3249         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3250         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3251         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3252         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3253         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3254         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3255         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3256
3257         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3258         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3259         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3260         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3261         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3262         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3263         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3264         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3265         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3266         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3267 };
3268
3269 static const struct nla_policy
3270         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3271         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3272         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3273         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3274         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3275                 .len = IEEE80211_MAX_DATA_LEN },
3276         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3277 };
3278
3279 static int nl80211_parse_mesh_config(struct genl_info *info,
3280                                      struct mesh_config *cfg,
3281                                      u32 *mask_out)
3282 {
3283         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3284         u32 mask = 0;
3285
3286 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3287 do {\
3288         if (table[attr_num]) {\
3289                 cfg->param = nla_fn(table[attr_num]); \
3290                 mask |= (1 << (attr_num - 1)); \
3291         } \
3292 } while (0);\
3293
3294
3295         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3296                 return -EINVAL;
3297         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3298                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3299                              nl80211_meshconf_params_policy))
3300                 return -EINVAL;
3301
3302         /* This makes sure that there aren't more than 32 mesh config
3303          * parameters (otherwise our bitfield scheme would not work.) */
3304         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3305
3306         /* Fill in the params struct */
3307         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3308                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3309         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3310                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3312                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3313         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3314                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3315         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3316                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3318                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3320                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3321         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3322                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3324                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3325                         nla_get_u8);
3326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3327                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3329                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3330                         nla_get_u16);
3331         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3332                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3333                         nla_get_u32);
3334         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3335                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3336                         nla_get_u16);
3337         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3338                         mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3339                         nla_get_u16);
3340         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3341                         dot11MeshHWMPnetDiameterTraversalTime,
3342                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3343                         nla_get_u16);
3344         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3345                         dot11MeshHWMPRootMode, mask,
3346                         NL80211_MESHCONF_HWMP_ROOTMODE,
3347                         nla_get_u8);
3348         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3349                         dot11MeshHWMPRannInterval, mask,
3350                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3351                         nla_get_u16);
3352         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3353                         dot11MeshGateAnnouncementProtocol, mask,
3354                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3355                         nla_get_u8);
3356         if (mask_out)
3357                 *mask_out = mask;
3358
3359         return 0;
3360
3361 #undef FILL_IN_MESH_PARAM_IF_SET
3362 }
3363
3364 static int nl80211_parse_mesh_setup(struct genl_info *info,
3365                                      struct mesh_setup *setup)
3366 {
3367         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3368
3369         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3370                 return -EINVAL;
3371         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3372                              info->attrs[NL80211_ATTR_MESH_SETUP],
3373                              nl80211_mesh_setup_params_policy))
3374                 return -EINVAL;
3375
3376         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3377                 setup->path_sel_proto =
3378                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3379                  IEEE80211_PATH_PROTOCOL_VENDOR :
3380                  IEEE80211_PATH_PROTOCOL_HWMP;
3381
3382         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3383                 setup->path_metric =
3384                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3385                  IEEE80211_PATH_METRIC_VENDOR :
3386                  IEEE80211_PATH_METRIC_AIRTIME;
3387
3388
3389         if (tb[NL80211_MESH_SETUP_IE]) {
3390                 struct nlattr *ieattr =
3391                         tb[NL80211_MESH_SETUP_IE];
3392                 if (!is_valid_ie_attr(ieattr))
3393                         return -EINVAL;
3394                 setup->ie = nla_data(ieattr);
3395                 setup->ie_len = nla_len(ieattr);
3396         }
3397         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3398         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3399
3400         return 0;
3401 }
3402
3403 static int nl80211_update_mesh_config(struct sk_buff *skb,
3404                                       struct genl_info *info)
3405 {
3406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3407         struct net_device *dev = info->user_ptr[1];
3408         struct wireless_dev *wdev = dev->ieee80211_ptr;
3409         struct mesh_config cfg;
3410         u32 mask;
3411         int err;
3412
3413         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3414                 return -EOPNOTSUPP;
3415
3416         if (!rdev->ops->update_mesh_config)
3417                 return -EOPNOTSUPP;
3418
3419         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3420         if (err)
3421                 return err;
3422
3423         wdev_lock(wdev);
3424         if (!wdev->mesh_id_len)
3425                 err = -ENOLINK;
3426
3427         if (!err)
3428                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3429                                                     mask, &cfg);
3430
3431         wdev_unlock(wdev);
3432
3433         return err;
3434 }
3435
3436 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3437 {
3438         struct sk_buff *msg;
3439         void *hdr = NULL;
3440         struct nlattr *nl_reg_rules;
3441         unsigned int i;
3442         int err = -EINVAL;
3443
3444         mutex_lock(&cfg80211_mutex);
3445
3446         if (!cfg80211_regdomain)
3447                 goto out;
3448
3449         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3450         if (!msg) {
3451                 err = -ENOBUFS;
3452                 goto out;
3453         }
3454
3455         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3456                              NL80211_CMD_GET_REG);
3457         if (!hdr)
3458                 goto put_failure;
3459
3460         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3461                 cfg80211_regdomain->alpha2);
3462         if (cfg80211_regdomain->dfs_region)
3463                 NLA_PUT_U8(msg, NL80211_ATTR_DFS_REGION,
3464                            cfg80211_regdomain->dfs_region);
3465
3466         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3467         if (!nl_reg_rules)
3468                 goto nla_put_failure;
3469
3470         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3471                 struct nlattr *nl_reg_rule;
3472                 const struct ieee80211_reg_rule *reg_rule;
3473                 const struct ieee80211_freq_range *freq_range;
3474                 const struct ieee80211_power_rule *power_rule;
3475
3476                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3477                 freq_range = &reg_rule->freq_range;
3478                 power_rule = &reg_rule->power_rule;
3479
3480                 nl_reg_rule = nla_nest_start(msg, i);
3481                 if (!nl_reg_rule)
3482                         goto nla_put_failure;
3483
3484                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3485                         reg_rule->flags);
3486                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3487                         freq_range->start_freq_khz);
3488                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3489                         freq_range->end_freq_khz);
3490                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3491                         freq_range->max_bandwidth_khz);
3492                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3493                         power_rule->max_antenna_gain);
3494                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3495                         power_rule->max_eirp);
3496
3497                 nla_nest_end(msg, nl_reg_rule);
3498         }
3499
3500         nla_nest_end(msg, nl_reg_rules);
3501
3502         genlmsg_end(msg, hdr);
3503         err = genlmsg_reply(msg, info);
3504         goto out;
3505
3506 nla_put_failure:
3507         genlmsg_cancel(msg, hdr);
3508 put_failure:
3509         nlmsg_free(msg);
3510         err = -EMSGSIZE;
3511 out:
3512         mutex_unlock(&cfg80211_mutex);
3513         return err;
3514 }
3515
3516 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3517 {
3518         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3519         struct nlattr *nl_reg_rule;
3520         char *alpha2 = NULL;
3521         int rem_reg_rules = 0, r = 0;
3522         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3523         u8 dfs_region = 0;
3524         struct ieee80211_regdomain *rd = NULL;
3525
3526         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3527                 return -EINVAL;
3528
3529         if (!info->attrs[NL80211_ATTR_REG_RULES])
3530                 return -EINVAL;
3531
3532         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3533
3534         if (info->attrs[NL80211_ATTR_DFS_REGION])
3535                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
3536
3537         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3538                         rem_reg_rules) {
3539                 num_rules++;
3540                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3541                         return -EINVAL;
3542         }
3543
3544         mutex_lock(&cfg80211_mutex);
3545
3546         if (!reg_is_valid_request(alpha2)) {
3547                 r = -EINVAL;
3548                 goto bad_reg;
3549         }
3550
3551         size_of_regd = sizeof(struct ieee80211_regdomain) +
3552                 (num_rules * sizeof(struct ieee80211_reg_rule));
3553
3554         rd = kzalloc(size_of_regd, GFP_KERNEL);
3555         if (!rd) {
3556                 r = -ENOMEM;
3557                 goto bad_reg;
3558         }
3559
3560         rd->n_reg_rules = num_rules;
3561         rd->alpha2[0] = alpha2[0];
3562         rd->alpha2[1] = alpha2[1];
3563
3564         /*
3565          * Disable DFS master mode if the DFS region was
3566          * not supported or known on this kernel.
3567          */
3568         if (reg_supported_dfs_region(dfs_region))
3569                 rd->dfs_region = dfs_region;
3570
3571         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3572                         rem_reg_rules) {
3573                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3574                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3575                         reg_rule_policy);
3576                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3577                 if (r)
3578                         goto bad_reg;
3579
3580                 rule_idx++;
3581
3582                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3583                         r = -EINVAL;
3584                         goto bad_reg;
3585                 }
3586         }
3587
3588         BUG_ON(rule_idx != num_rules);
3589
3590         r = set_regdom(rd);
3591
3592         mutex_unlock(&cfg80211_mutex);
3593
3594         return r;
3595
3596  bad_reg:
3597         mutex_unlock(&cfg80211_mutex);
3598         kfree(rd);
3599         return r;
3600 }
3601
3602 static int validate_scan_freqs(struct nlattr *freqs)
3603 {
3604         struct nlattr *attr1, *attr2;
3605         int n_channels = 0, tmp1, tmp2;
3606
3607         nla_for_each_nested(attr1, freqs, tmp1) {
3608                 n_channels++;
3609                 /*
3610                  * Some hardware has a limited channel list for
3611                  * scanning, and it is pretty much nonsensical
3612                  * to scan for a channel twice, so disallow that
3613                  * and don't require drivers to check that the
3614                  * channel list they get isn't longer than what
3615                  * they can scan, as long as they can scan all
3616                  * the channels they registered at once.
3617                  */
3618                 nla_for_each_nested(attr2, freqs, tmp2)
3619                         if (attr1 != attr2 &&
3620                             nla_get_u32(attr1) == nla_get_u32(attr2))
3621                                 return 0;
3622         }
3623
3624         return n_channels;
3625 }
3626
3627 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3628 {
3629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3630         struct net_device *dev = info->user_ptr[1];
3631         struct cfg80211_scan_request *request;
3632         struct nlattr *attr;
3633         struct wiphy *wiphy;
3634         int err, tmp, n_ssids = 0, n_channels, i;
3635         size_t ie_len;
3636
3637         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3638                 return -EINVAL;
3639
3640         wiphy = &rdev->wiphy;
3641
3642         if (!rdev->ops->scan)
3643                 return -EOPNOTSUPP;
3644
3645         if (rdev->scan_req)
3646                 return -EBUSY;
3647
3648         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3649                 n_channels = validate_scan_freqs(
3650                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3651                 if (!n_channels)
3652                         return -EINVAL;
3653         } else {
3654                 enum ieee80211_band band;
3655                 n_channels = 0;
3656
3657                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3658                         if (wiphy->bands[band])
3659                                 n_channels += wiphy->bands[band]->n_channels;
3660         }
3661
3662         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3663                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3664                         n_ssids++;
3665
3666         if (n_ssids > wiphy->max_scan_ssids)
3667                 return -EINVAL;
3668
3669         if (info->attrs[NL80211_ATTR_IE])
3670                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3671         else
3672                 ie_len = 0;
3673
3674         if (ie_len > wiphy->max_scan_ie_len)
3675                 return -EINVAL;
3676
3677         request = kzalloc(sizeof(*request)
3678                         + sizeof(*request->ssids) * n_ssids
3679                         + sizeof(*request->channels) * n_channels
3680                         + ie_len, GFP_KERNEL);
3681         if (!request)
3682                 return -ENOMEM;
3683
3684         if (n_ssids)
3685                 request->ssids = (void *)&request->channels[n_channels];
3686         request->n_ssids = n_ssids;
3687         if (ie_len) {
3688                 if (request->ssids)
3689                         request->ie = (void *)(request->ssids + n_ssids);
3690                 else
3691                         request->ie = (void *)(request->channels + n_channels);
3692         }
3693
3694         i = 0;
3695         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3696                 /* user specified, bail out if channel not found */
3697                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3698                         struct ieee80211_channel *chan;
3699
3700                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3701
3702                         if (!chan) {
3703                                 err = -EINVAL;
3704                                 goto out_free;
3705                         }
3706
3707                         /* ignore disabled channels */
3708                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3709                                 continue;
3710
3711                         request->channels[i] = chan;
3712                         i++;
3713                 }
3714         } else {
3715                 enum ieee80211_band band;
3716
3717                 /* all channels */
3718                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3719                         int j;
3720                         if (!wiphy->bands[band])
3721                                 continue;
3722                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3723                                 struct ieee80211_channel *chan;
3724
3725                                 chan = &wiphy->bands[band]->channels[j];
3726
3727                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3728                                         continue;
3729
3730                                 request->channels[i] = chan;
3731                                 i++;
3732                         }
3733                 }
3734         }
3735
3736         if (!i) {
3737                 err = -EINVAL;
3738                 goto out_free;
3739         }
3740
3741         request->n_channels = i;
3742
3743         i = 0;
3744         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3745                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3746                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3747                                 err = -EINVAL;
3748                                 goto out_free;
3749                         }
3750                         request->ssids[i].ssid_len = nla_len(attr);
3751                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3752                         i++;
3753                 }
3754         }
3755
3756         if (info->attrs[NL80211_ATTR_IE]) {
3757                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3758                 memcpy((void *)request->ie,
3759                        nla_data(info->attrs[NL80211_ATTR_IE]),
3760                        request->ie_len);
3761         }
3762
3763         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3764                 if (wiphy->bands[i])
3765                         request->rates[i] =
3766                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3767
3768         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3769                 nla_for_each_nested(attr,
3770                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3771                                     tmp) {
3772                         enum ieee80211_band band = nla_type(attr);
3773
3774                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3775                                 err = -EINVAL;
3776                                 goto out_free;
3777                         }
3778                         err = ieee80211_get_ratemask(wiphy->bands[band],
3779                                                      nla_data(attr),
3780                                                      nla_len(attr),
3781                                                      &request->rates[band]);
3782                         if (err)
3783                                 goto out_free;
3784                 }
3785         }
3786
3787         request->no_cck =
3788                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
3789
3790         request->dev = dev;
3791         request->wiphy = &rdev->wiphy;
3792
3793         rdev->scan_req = request;
3794         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3795
3796         if (!err) {
3797                 nl80211_send_scan_start(rdev, dev);
3798                 dev_hold(dev);
3799         } else {
3800  out_free:
3801                 rdev->scan_req = NULL;
3802                 kfree(request);
3803         }
3804
3805         return err;
3806 }
3807
3808 static int nl80211_start_sched_scan(struct sk_buff *skb,
3809                                     struct genl_info *info)
3810 {
3811         struct cfg80211_sched_scan_request *request;
3812         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3813         struct net_device *dev = info->user_ptr[1];
3814         struct nlattr *attr;
3815         struct wiphy *wiphy;
3816         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
3817         u32 interval;
3818         enum ieee80211_band band;
3819         size_t ie_len;
3820         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
3821
3822         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3823             !rdev->ops->sched_scan_start)
3824                 return -EOPNOTSUPP;
3825
3826         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3827                 return -EINVAL;
3828
3829         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3830                 return -EINVAL;
3831
3832         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3833         if (interval == 0)
3834                 return -EINVAL;
3835
3836         wiphy = &rdev->wiphy;
3837
3838         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3839                 n_channels = validate_scan_freqs(
3840                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3841                 if (!n_channels)
3842                         return -EINVAL;
3843         } else {
3844                 n_channels = 0;
3845
3846                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3847                         if (wiphy->bands[band])
3848                                 n_channels += wiphy->bands[band]->n_channels;
3849         }
3850
3851         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3852                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3853                                     tmp)
3854                         n_ssids++;
3855
3856         if (n_ssids > wiphy->max_sched_scan_ssids)
3857                 return -EINVAL;
3858
3859         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
3860                 nla_for_each_nested(attr,
3861                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3862                                     tmp)
3863                         n_match_sets++;
3864
3865         if (n_match_sets > wiphy->max_match_sets)
3866                 return -EINVAL;
3867
3868         if (info->attrs[NL80211_ATTR_IE])
3869                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3870         else
3871                 ie_len = 0;
3872
3873         if (ie_len > wiphy->max_sched_scan_ie_len)
3874                 return -EINVAL;
3875
3876         mutex_lock(&rdev->sched_scan_mtx);
3877
3878         if (rdev->sched_scan_req) {
3879                 err = -EINPROGRESS;
3880                 goto out;
3881         }
3882
3883         request = kzalloc(sizeof(*request)
3884                         + sizeof(*request->ssids) * n_ssids
3885                         + sizeof(*request->match_sets) * n_match_sets
3886                         + sizeof(*request->channels) * n_channels
3887                         + ie_len, GFP_KERNEL);
3888         if (!request) {
3889                 err = -ENOMEM;
3890                 goto out;
3891         }
3892
3893         if (n_ssids)
3894                 request->ssids = (void *)&request->channels[n_channels];
3895         request->n_ssids = n_ssids;
3896         if (ie_len) {
3897                 if (request->ssids)
3898                         request->ie = (void *)(request->ssids + n_ssids);
3899                 else
3900                         request->ie = (void *)(request->channels + n_channels);
3901         }
3902
3903         if (n_match_sets) {
3904                 if (request->ie)
3905                         request->match_sets = (void *)(request->ie + ie_len);
3906                 else if (request->ssids)
3907                         request->match_sets =
3908                                 (void *)(request->ssids + n_ssids);
3909                 else
3910                         request->match_sets =
3911                                 (void *)(request->channels + n_channels);
3912         }
3913         request->n_match_sets = n_match_sets;
3914
3915         i = 0;
3916         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3917                 /* user specified, bail out if channel not found */
3918                 nla_for_each_nested(attr,
3919                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3920                                     tmp) {
3921                         struct ieee80211_channel *chan;
3922
3923                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3924
3925                         if (!chan) {
3926                                 err = -EINVAL;
3927                                 goto out_free;
3928                         }
3929
3930                         /* ignore disabled channels */
3931                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3932                                 continue;
3933
3934                         request->channels[i] = chan;
3935                         i++;
3936                 }
3937         } else {
3938                 /* all channels */
3939                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3940                         int j;
3941                         if (!wiphy->bands[band])
3942                                 continue;
3943                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3944                                 struct ieee80211_channel *chan;
3945
3946                                 chan = &wiphy->bands[band]->channels[j];
3947
3948                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3949                                         continue;
3950
3951                                 request->channels[i] = chan;
3952                                 i++;
3953                         }
3954                 }
3955         }
3956
3957         if (!i) {
3958                 err = -EINVAL;
3959                 goto out_free;
3960         }
3961
3962         request->n_channels = i;
3963
3964         i = 0;
3965         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3966                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3967                                     tmp) {
3968                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3969                                 err = -EINVAL;
3970                                 goto out_free;
3971                         }
3972                         request->ssids[i].ssid_len = nla_len(attr);
3973                         memcpy(request->ssids[i].ssid, nla_data(attr),
3974                                nla_len(attr));
3975                         i++;
3976                 }
3977         }
3978
3979         i = 0;
3980         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
3981                 nla_for_each_nested(attr,
3982                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3983                                     tmp) {
3984                         struct nlattr *ssid;
3985
3986                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
3987                                   nla_data(attr), nla_len(attr),
3988                                   nl80211_match_policy);
3989                         ssid = tb[NL80211_ATTR_SCHED_SCAN_MATCH_SSID];
3990                         if (ssid) {
3991                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
3992                                         err = -EINVAL;
3993                                         goto out_free;
3994                                 }
3995                                 memcpy(request->match_sets[i].ssid.ssid,
3996                                        nla_data(ssid), nla_len(ssid));
3997                                 request->match_sets[i].ssid.ssid_len =
3998                                         nla_len(ssid);
3999                         }
4000                         i++;
4001                 }
4002         }
4003
4004         if (info->attrs[NL80211_ATTR_IE]) {
4005                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4006                 memcpy((void *)request->ie,
4007                        nla_data(info->attrs[NL80211_ATTR_IE]),
4008                        request->ie_len);
4009         }
4010
4011         request->dev = dev;
4012         request->wiphy = &rdev->wiphy;
4013         request->interval = interval;
4014
4015         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
4016         if (!err) {
4017                 rdev->sched_scan_req = request;
4018                 nl80211_send_sched_scan(rdev, dev,
4019                                         NL80211_CMD_START_SCHED_SCAN);
4020                 goto out;
4021         }
4022
4023 out_free:
4024         kfree(request);
4025 out:
4026         mutex_unlock(&rdev->sched_scan_mtx);
4027         return err;
4028 }
4029
4030 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4031                                    struct genl_info *info)
4032 {
4033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4034         int err;
4035
4036         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4037             !rdev->ops->sched_scan_stop)
4038                 return -EOPNOTSUPP;
4039
4040         mutex_lock(&rdev->sched_scan_mtx);
4041         err = __cfg80211_stop_sched_scan(rdev, false);
4042         mutex_unlock(&rdev->sched_scan_mtx);
4043
4044         return err;
4045 }
4046
4047 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4048                             u32 seq, int flags,
4049                             struct cfg80211_registered_device *rdev,
4050                             struct wireless_dev *wdev,
4051                             struct cfg80211_internal_bss *intbss)
4052 {
4053         struct cfg80211_bss *res = &intbss->pub;
4054         void *hdr;
4055         struct nlattr *bss;
4056         int i;
4057
4058         ASSERT_WDEV_LOCK(wdev);
4059
4060         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
4061                              NL80211_CMD_NEW_SCAN_RESULTS);
4062         if (!hdr)
4063                 return -1;
4064
4065         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4066
4067         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
4068         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
4069
4070         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4071         if (!bss)
4072                 goto nla_put_failure;
4073         if (!is_zero_ether_addr(res->bssid))
4074                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
4075         if (res->information_elements && res->len_information_elements)
4076                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4077                         res->len_information_elements,
4078                         res->information_elements);
4079         if (res->beacon_ies && res->len_beacon_ies &&
4080             res->beacon_ies != res->information_elements)
4081                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
4082                         res->len_beacon_ies, res->beacon_ies);
4083         if (res->tsf)
4084                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
4085         if (res->beacon_interval)
4086                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
4087         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
4088         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
4089         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
4090                 jiffies_to_msecs(jiffies - intbss->ts));
4091
4092         switch (rdev->wiphy.signal_type) {
4093         case CFG80211_SIGNAL_TYPE_MBM:
4094                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
4095                 break;
4096         case CFG80211_SIGNAL_TYPE_UNSPEC:
4097                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
4098                 break;
4099         default:
4100                 break;
4101         }
4102
4103         switch (wdev->iftype) {
4104         case NL80211_IFTYPE_P2P_CLIENT:
4105         case NL80211_IFTYPE_STATION:
4106                 if (intbss == wdev->current_bss)
4107                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
4108                                     NL80211_BSS_STATUS_ASSOCIATED);
4109                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
4110                         if (intbss != wdev->auth_bsses[i])
4111                                 continue;
4112                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
4113                                     NL80211_BSS_STATUS_AUTHENTICATED);
4114                         break;
4115                 }
4116                 break;
4117         case NL80211_IFTYPE_ADHOC:
4118                 if (intbss == wdev->current_bss)
4119                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
4120                                     NL80211_BSS_STATUS_IBSS_JOINED);
4121                 break;
4122         default:
4123                 break;
4124         }
4125
4126         nla_nest_end(msg, bss);
4127
4128         return genlmsg_end(msg, hdr);
4129
4130  nla_put_failure:
4131         genlmsg_cancel(msg, hdr);
4132         return -EMSGSIZE;
4133 }
4134
4135 static int nl80211_dump_scan(struct sk_buff *skb,
4136                              struct netlink_callback *cb)
4137 {
4138         struct cfg80211_registered_device *rdev;
4139         struct net_device *dev;
4140         struct cfg80211_internal_bss *scan;
4141         struct wireless_dev *wdev;
4142         int start = cb->args[1], idx = 0;
4143         int err;
4144
4145         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4146         if (err)
4147                 return err;
4148
4149         wdev = dev->ieee80211_ptr;
4150
4151         wdev_lock(wdev);
4152         spin_lock_bh(&rdev->bss_lock);
4153         cfg80211_bss_expire(rdev);
4154
4155         cb->seq = rdev->bss_generation;
4156
4157         list_for_each_entry(scan, &rdev->bss_list, list) {
4158                 if (++idx <= start)
4159                         continue;
4160                 if (nl80211_send_bss(skb, cb,
4161                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4162                                 rdev, wdev, scan) < 0) {
4163                         idx--;
4164                         break;
4165                 }
4166         }
4167
4168         spin_unlock_bh(&rdev->bss_lock);
4169         wdev_unlock(wdev);
4170
4171         cb->args[1] = idx;
4172         nl80211_finish_netdev_dump(rdev);
4173
4174         return skb->len;
4175 }
4176
4177 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4178                                 int flags, struct net_device *dev,
4179                                 struct survey_info *survey)
4180 {
4181         void *hdr;
4182         struct nlattr *infoattr;
4183
4184         hdr = nl80211hdr_put(msg, pid, seq, flags,
4185                              NL80211_CMD_NEW_SURVEY_RESULTS);
4186         if (!hdr)
4187                 return -ENOMEM;
4188
4189         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
4190
4191         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4192         if (!infoattr)
4193                 goto nla_put_failure;
4194
4195         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4196                     survey->channel->center_freq);
4197         if (survey->filled & SURVEY_INFO_NOISE_DBM)
4198                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
4199                             survey->noise);
4200         if (survey->filled & SURVEY_INFO_IN_USE)
4201                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
4202         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
4203                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4204                             survey->channel_time);
4205         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
4206                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4207                             survey->channel_time_busy);
4208         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
4209                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4210                             survey->channel_time_ext_busy);
4211         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
4212                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4213                             survey->channel_time_rx);
4214         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
4215                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4216                             survey->channel_time_tx);
4217
4218         nla_nest_end(msg, infoattr);
4219
4220         return genlmsg_end(msg, hdr);
4221
4222  nla_put_failure:
4223         genlmsg_cancel(msg, hdr);
4224         return -EMSGSIZE;
4225 }
4226
4227 static int nl80211_dump_survey(struct sk_buff *skb,
4228                         struct netlink_callback *cb)
4229 {
4230         struct survey_info survey;
4231         struct cfg80211_registered_device *dev;
4232         struct net_device *netdev;
4233         int survey_idx = cb->args[1];
4234         int res;
4235
4236         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4237         if (res)
4238                 return res;
4239
4240         if (!dev->ops->dump_survey) {
4241                 res = -EOPNOTSUPP;
4242                 goto out_err;
4243         }
4244
4245         while (1) {
4246                 struct ieee80211_channel *chan;
4247
4248                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4249                                             &survey);
4250                 if (res == -ENOENT)
4251                         break;
4252                 if (res)
4253                         goto out_err;
4254
4255                 /* Survey without a channel doesn't make sense */
4256                 if (!survey.channel) {
4257                         res = -EINVAL;
4258                         goto out;
4259                 }
4260
4261                 chan = ieee80211_get_channel(&dev->wiphy,
4262                                              survey.channel->center_freq);
4263                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4264                         survey_idx++;
4265                         continue;
4266                 }
4267
4268                 if (nl80211_send_survey(skb,
4269                                 NETLINK_CB(cb->skb).pid,
4270                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4271                                 netdev,
4272                                 &survey) < 0)
4273                         goto out;
4274                 survey_idx++;
4275         }
4276
4277  out:
4278         cb->args[1] = survey_idx;
4279         res = skb->len;
4280  out_err:
4281         nl80211_finish_netdev_dump(dev);
4282         return res;
4283 }
4284
4285 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4286 {
4287         return auth_type <= NL80211_AUTHTYPE_MAX;
4288 }
4289
4290 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4291 {
4292         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4293                                   NL80211_WPA_VERSION_2));
4294 }
4295
4296 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4297 {
4298         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4299         struct net_device *dev = info->user_ptr[1];
4300         struct ieee80211_channel *chan;
4301         const u8 *bssid, *ssid, *ie = NULL;
4302         int err, ssid_len, ie_len = 0;
4303         enum nl80211_auth_type auth_type;
4304         struct key_parse key;
4305         bool local_state_change;
4306
4307         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4308                 return -EINVAL;
4309
4310         if (!info->attrs[NL80211_ATTR_MAC])
4311                 return -EINVAL;
4312
4313         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4314                 return -EINVAL;
4315
4316         if (!info->attrs[NL80211_ATTR_SSID])
4317                 return -EINVAL;
4318
4319         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4320                 return -EINVAL;
4321
4322         err = nl80211_parse_key(info, &key);
4323         if (err)
4324                 return err;
4325
4326         if (key.idx >= 0) {
4327                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4328                         return -EINVAL;
4329                 if (!key.p.key || !key.p.key_len)
4330                         return -EINVAL;
4331                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4332                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4333                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4334                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4335                         return -EINVAL;
4336                 if (key.idx > 4)
4337                         return -EINVAL;
4338         } else {
4339                 key.p.key_len = 0;
4340                 key.p.key = NULL;
4341         }
4342
4343         if (key.idx >= 0) {
4344                 int i;
4345                 bool ok = false;
4346                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4347                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4348                                 ok = true;
4349                                 break;
4350                         }
4351                 }
4352                 if (!ok)
4353                         return -EINVAL;
4354         }
4355
4356         if (!rdev->ops->auth)
4357                 return -EOPNOTSUPP;
4358
4359         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4360             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4361                 return -EOPNOTSUPP;
4362
4363         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4364         chan = ieee80211_get_channel(&rdev->wiphy,
4365                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4366         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4367                 return -EINVAL;
4368
4369         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4370         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4371
4372         if (info->attrs[NL80211_ATTR_IE]) {
4373                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4374                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4375         }
4376
4377         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4378         if (!nl80211_valid_auth_type(auth_type))
4379                 return -EINVAL;
4380
4381         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4382
4383         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4384                                   ssid, ssid_len, ie, ie_len,
4385                                   key.p.key, key.p.key_len, key.idx,
4386                                   local_state_change);
4387 }
4388
4389 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4390                                    struct genl_info *info,
4391                                    struct cfg80211_crypto_settings *settings,
4392                                    int cipher_limit)
4393 {
4394         memset(settings, 0, sizeof(*settings));
4395
4396         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4397
4398         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4399                 u16 proto;
4400                 proto = nla_get_u16(
4401                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4402                 settings->control_port_ethertype = cpu_to_be16(proto);
4403                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4404                     proto != ETH_P_PAE)
4405                         return -EINVAL;
4406                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4407                         settings->control_port_no_encrypt = true;
4408         } else
4409                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4410
4411         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4412                 void *data;
4413                 int len, i;
4414
4415                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4416                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4417                 settings->n_ciphers_pairwise = len / sizeof(u32);
4418
4419                 if (len % sizeof(u32))
4420                         return -EINVAL;
4421
4422                 if (settings->n_ciphers_pairwise > cipher_limit)
4423                         return -EINVAL;
4424
4425                 memcpy(settings->ciphers_pairwise, data, len);
4426
4427                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4428                         if (!cfg80211_supported_cipher_suite(
4429                                         &rdev->wiphy,
4430                                         settings->ciphers_pairwise[i]))
4431                                 return -EINVAL;
4432         }
4433
4434         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4435                 settings->cipher_group =
4436                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4437                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
4438                                                      settings->cipher_group))
4439                         return -EINVAL;
4440         }
4441
4442         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4443                 settings->wpa_versions =
4444                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4445                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4446                         return -EINVAL;
4447         }
4448
4449         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4450                 void *data;
4451                 int len;
4452
4453                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4454                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4455                 settings->n_akm_suites = len / sizeof(u32);
4456
4457                 if (len % sizeof(u32))
4458                         return -EINVAL;
4459
4460                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
4461                         return -EINVAL;
4462
4463                 memcpy(settings->akm_suites, data, len);
4464         }
4465
4466         return 0;
4467 }
4468
4469 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4470 {
4471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4472         struct net_device *dev = info->user_ptr[1];
4473         struct cfg80211_crypto_settings crypto;
4474         struct ieee80211_channel *chan;
4475         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4476         int err, ssid_len, ie_len = 0;
4477         bool use_mfp = false;
4478         u32 flags = 0;
4479         struct ieee80211_ht_cap *ht_capa = NULL;
4480         struct ieee80211_ht_cap *ht_capa_mask = NULL;
4481
4482         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4483                 return -EINVAL;
4484
4485         if (!info->attrs[NL80211_ATTR_MAC] ||
4486             !info->attrs[NL80211_ATTR_SSID] ||
4487             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4488                 return -EINVAL;
4489
4490         if (!rdev->ops->assoc)
4491                 return -EOPNOTSUPP;
4492
4493         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4494             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4495                 return -EOPNOTSUPP;
4496
4497         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4498
4499         chan = ieee80211_get_channel(&rdev->wiphy,
4500                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4501         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4502                 return -EINVAL;
4503
4504         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4505         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4506
4507         if (info->attrs[NL80211_ATTR_IE]) {
4508                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4509                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4510         }
4511
4512         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4513                 enum nl80211_mfp mfp =
4514                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4515                 if (mfp == NL80211_MFP_REQUIRED)
4516                         use_mfp = true;
4517                 else if (mfp != NL80211_MFP_NO)
4518                         return -EINVAL;
4519         }
4520
4521         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4522                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4523
4524         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
4525                 flags |= ASSOC_REQ_DISABLE_HT;
4526
4527         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
4528                 ht_capa_mask =
4529                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
4530
4531         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
4532                 if (!ht_capa_mask)
4533                         return -EINVAL;
4534                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4535         }
4536
4537         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4538         if (!err)
4539                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4540                                           ssid, ssid_len, ie, ie_len, use_mfp,
4541                                           &crypto, flags, ht_capa,
4542                                           ht_capa_mask);
4543
4544         return err;
4545 }
4546
4547 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4548 {
4549         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4550         struct net_device *dev = info->user_ptr[1];
4551         const u8 *ie = NULL, *bssid;
4552         int ie_len = 0;
4553         u16 reason_code;
4554         bool local_state_change;
4555
4556         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4557                 return -EINVAL;
4558
4559         if (!info->attrs[NL80211_ATTR_MAC])
4560                 return -EINVAL;
4561
4562         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4563                 return -EINVAL;
4564
4565         if (!rdev->ops->deauth)
4566                 return -EOPNOTSUPP;
4567
4568         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4569             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4570                 return -EOPNOTSUPP;
4571
4572         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4573
4574         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4575         if (reason_code == 0) {
4576                 /* Reason Code 0 is reserved */
4577                 return -EINVAL;
4578         }
4579
4580         if (info->attrs[NL80211_ATTR_IE]) {
4581                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4582                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4583         }
4584
4585         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4586
4587         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4588                                     local_state_change);
4589 }
4590
4591 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4592 {
4593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4594         struct net_device *dev = info->user_ptr[1];
4595         const u8 *ie = NULL, *bssid;
4596         int ie_len = 0;
4597         u16 reason_code;
4598         bool local_state_change;
4599
4600         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4601                 return -EINVAL;
4602
4603         if (!info->attrs[NL80211_ATTR_MAC])
4604                 return -EINVAL;
4605
4606         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4607                 return -EINVAL;
4608
4609         if (!rdev->ops->disassoc)
4610                 return -EOPNOTSUPP;
4611
4612         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4613             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4614                 return -EOPNOTSUPP;
4615
4616         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4617
4618         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4619         if (reason_code == 0) {
4620                 /* Reason Code 0 is reserved */
4621                 return -EINVAL;
4622         }
4623
4624         if (info->attrs[NL80211_ATTR_IE]) {
4625                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4626                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4627         }
4628
4629         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4630
4631         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4632                                       local_state_change);
4633 }
4634
4635 static bool
4636 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4637                          int mcast_rate[IEEE80211_NUM_BANDS],
4638                          int rateval)
4639 {
4640         struct wiphy *wiphy = &rdev->wiphy;
4641         bool found = false;
4642         int band, i;
4643
4644         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4645                 struct ieee80211_supported_band *sband;
4646
4647                 sband = wiphy->bands[band];
4648                 if (!sband)
4649                         continue;
4650
4651                 for (i = 0; i < sband->n_bitrates; i++) {
4652                         if (sband->bitrates[i].bitrate == rateval) {
4653                                 mcast_rate[band] = i + 1;
4654                                 found = true;
4655                                 break;
4656                         }
4657                 }
4658         }
4659
4660         return found;
4661 }
4662
4663 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4664 {
4665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4666         struct net_device *dev = info->user_ptr[1];
4667         struct cfg80211_ibss_params ibss;
4668         struct wiphy *wiphy;
4669         struct cfg80211_cached_keys *connkeys = NULL;
4670         int err;
4671
4672         memset(&ibss, 0, sizeof(ibss));
4673
4674         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4675                 return -EINVAL;
4676
4677         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4678             !info->attrs[NL80211_ATTR_SSID] ||
4679             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4680                 return -EINVAL;
4681
4682         ibss.beacon_interval = 100;
4683
4684         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4685                 ibss.beacon_interval =
4686                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4687                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4688                         return -EINVAL;
4689         }
4690
4691         if (!rdev->ops->join_ibss)
4692                 return -EOPNOTSUPP;
4693
4694         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4695                 return -EOPNOTSUPP;
4696
4697         wiphy = &rdev->wiphy;
4698
4699         if (info->attrs[NL80211_ATTR_MAC]) {
4700                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4701
4702                 if (!is_valid_ether_addr(ibss.bssid))
4703                         return -EINVAL;
4704         }
4705         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4706         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4707
4708         if (info->attrs[NL80211_ATTR_IE]) {
4709                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4710                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4711         }
4712
4713         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4714                 enum nl80211_channel_type channel_type;
4715
4716                 channel_type = nla_get_u32(
4717                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4718                 if (channel_type != NL80211_CHAN_NO_HT &&
4719                     channel_type != NL80211_CHAN_HT20 &&
4720                     channel_type != NL80211_CHAN_HT40MINUS &&
4721                     channel_type != NL80211_CHAN_HT40PLUS)
4722                         return -EINVAL;
4723
4724                 if (channel_type != NL80211_CHAN_NO_HT &&
4725                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
4726                         return -EINVAL;
4727
4728                 ibss.channel_type = channel_type;
4729         } else {
4730                 ibss.channel_type = NL80211_CHAN_NO_HT;
4731         }
4732
4733         ibss.channel = rdev_freq_to_chan(rdev,
4734                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
4735                 ibss.channel_type);
4736         if (!ibss.channel ||
4737             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4738             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4739                 return -EINVAL;
4740
4741         /* Both channels should be able to initiate communication */
4742         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
4743              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
4744             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
4745                                           ibss.channel_type))
4746                 return -EINVAL;
4747
4748         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4749         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4750
4751         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4752                 u8 *rates =
4753                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4754                 int n_rates =
4755                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4756                 struct ieee80211_supported_band *sband =
4757                         wiphy->bands[ibss.channel->band];
4758                 int err;
4759
4760                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4761                                              &ibss.basic_rates);
4762                 if (err)
4763                         return err;
4764         }
4765
4766         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4767             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4768                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4769                 return -EINVAL;
4770
4771         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4772                 connkeys = nl80211_parse_connkeys(rdev,
4773                                         info->attrs[NL80211_ATTR_KEYS]);
4774                 if (IS_ERR(connkeys))
4775                         return PTR_ERR(connkeys);
4776         }
4777
4778         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4779         if (err)
4780                 kfree(connkeys);
4781         return err;
4782 }
4783
4784 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4785 {
4786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4787         struct net_device *dev = info->user_ptr[1];
4788
4789         if (!rdev->ops->leave_ibss)
4790                 return -EOPNOTSUPP;
4791
4792         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4793                 return -EOPNOTSUPP;
4794
4795         return cfg80211_leave_ibss(rdev, dev, false);
4796 }
4797
4798 #ifdef CONFIG_NL80211_TESTMODE
4799 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4800         .name = "testmode",
4801 };
4802
4803 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4804 {
4805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4806         int err;
4807
4808         if (!info->attrs[NL80211_ATTR_TESTDATA])
4809                 return -EINVAL;
4810
4811         err = -EOPNOTSUPP;
4812         if (rdev->ops->testmode_cmd) {
4813                 rdev->testmode_info = info;
4814                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4815                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4816                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4817                 rdev->testmode_info = NULL;
4818         }
4819
4820         return err;
4821 }
4822
4823 static int nl80211_testmode_dump(struct sk_buff *skb,
4824                                  struct netlink_callback *cb)
4825 {
4826         struct cfg80211_registered_device *rdev;
4827         int err;
4828         long phy_idx;
4829         void *data = NULL;
4830         int data_len = 0;
4831
4832         if (cb->args[0]) {
4833                 /*
4834                  * 0 is a valid index, but not valid for args[0],
4835                  * so we need to offset by 1.
4836                  */
4837                 phy_idx = cb->args[0] - 1;
4838         } else {
4839                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4840                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4841                                   nl80211_policy);
4842                 if (err)
4843                         return err;
4844                 if (nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]) {
4845                         phy_idx = nla_get_u32(
4846                                 nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4847                 } else {
4848                         struct net_device *netdev;
4849
4850                         err = get_rdev_dev_by_ifindex(sock_net(skb->sk),
4851                                                       nl80211_fam.attrbuf,
4852                                                       &rdev, &netdev);
4853                         if (err)
4854                                 return err;
4855                         dev_put(netdev);
4856                         phy_idx = rdev->wiphy_idx;
4857                         cfg80211_unlock_rdev(rdev);
4858                 }
4859                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4860                         cb->args[1] =
4861                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4862         }
4863
4864         if (cb->args[1]) {
4865                 data = nla_data((void *)cb->args[1]);
4866                 data_len = nla_len((void *)cb->args[1]);
4867         }
4868
4869         mutex_lock(&cfg80211_mutex);
4870         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4871         if (!rdev) {
4872                 mutex_unlock(&cfg80211_mutex);
4873                 return -ENOENT;
4874         }
4875         cfg80211_lock_rdev(rdev);
4876         mutex_unlock(&cfg80211_mutex);
4877
4878         if (!rdev->ops->testmode_dump) {
4879                 err = -EOPNOTSUPP;
4880                 goto out_err;
4881         }
4882
4883         while (1) {
4884                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4885                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4886                                            NL80211_CMD_TESTMODE);
4887                 struct nlattr *tmdata;
4888
4889                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx) < 0) {
4890                         genlmsg_cancel(skb, hdr);
4891                         break;
4892                 }
4893
4894                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4895                 if (!tmdata) {
4896                         genlmsg_cancel(skb, hdr);
4897                         break;
4898                 }
4899                 err = rdev->ops->testmode_dump(&rdev->wiphy, skb, cb,
4900                                                data, data_len);
4901                 nla_nest_end(skb, tmdata);
4902
4903                 if (err == -ENOBUFS || err == -ENOENT) {
4904                         genlmsg_cancel(skb, hdr);
4905                         break;
4906                 } else if (err) {
4907                         genlmsg_cancel(skb, hdr);
4908                         goto out_err;
4909                 }
4910
4911                 genlmsg_end(skb, hdr);
4912         }
4913
4914         err = skb->len;
4915         /* see above */
4916         cb->args[0] = phy_idx + 1;
4917  out_err:
4918         cfg80211_unlock_rdev(rdev);
4919         return err;
4920 }
4921
4922 static struct sk_buff *
4923 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4924                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4925 {
4926         struct sk_buff *skb;
4927         void *hdr;
4928         struct nlattr *data;
4929
4930         skb = nlmsg_new(approxlen + 100, gfp);
4931         if (!skb)
4932                 return NULL;
4933
4934         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4935         if (!hdr) {
4936                 kfree_skb(skb);
4937                 return NULL;
4938         }
4939
4940         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4941         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4942
4943         ((void **)skb->cb)[0] = rdev;
4944         ((void **)skb->cb)[1] = hdr;
4945         ((void **)skb->cb)[2] = data;
4946
4947         return skb;
4948
4949  nla_put_failure:
4950         kfree_skb(skb);
4951         return NULL;
4952 }
4953
4954 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4955                                                   int approxlen)
4956 {
4957         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4958
4959         if (WARN_ON(!rdev->testmode_info))
4960                 return NULL;
4961
4962         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4963                                 rdev->testmode_info->snd_pid,
4964                                 rdev->testmode_info->snd_seq,
4965                                 GFP_KERNEL);
4966 }
4967 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4968
4969 int cfg80211_testmode_reply(struct sk_buff *skb)
4970 {
4971         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4972         void *hdr = ((void **)skb->cb)[1];
4973         struct nlattr *data = ((void **)skb->cb)[2];
4974
4975         if (WARN_ON(!rdev->testmode_info)) {
4976                 kfree_skb(skb);
4977                 return -EINVAL;
4978         }
4979
4980         nla_nest_end(skb, data);
4981         genlmsg_end(skb, hdr);
4982         return genlmsg_reply(skb, rdev->testmode_info);
4983 }
4984 EXPORT_SYMBOL(cfg80211_testmode_reply);
4985
4986 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4987                                                   int approxlen, gfp_t gfp)
4988 {
4989         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4990
4991         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4992 }
4993 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4994
4995 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4996 {
4997         void *hdr = ((void **)skb->cb)[1];
4998         struct nlattr *data = ((void **)skb->cb)[2];
4999
5000         nla_nest_end(skb, data);
5001         genlmsg_end(skb, hdr);
5002         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5003 }
5004 EXPORT_SYMBOL(cfg80211_testmode_event);
5005 #endif
5006
5007 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5008 {
5009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5010         struct net_device *dev = info->user_ptr[1];
5011         struct cfg80211_connect_params connect;
5012         struct wiphy *wiphy;
5013         struct cfg80211_cached_keys *connkeys = NULL;
5014         int err;
5015
5016         memset(&connect, 0, sizeof(connect));
5017
5018         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5019                 return -EINVAL;
5020
5021         if (!info->attrs[NL80211_ATTR_SSID] ||
5022             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5023                 return -EINVAL;
5024
5025         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5026                 connect.auth_type =
5027                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5028                 if (!nl80211_valid_auth_type(connect.auth_type))
5029                         return -EINVAL;
5030         } else
5031                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5032
5033         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5034
5035         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5036                                       NL80211_MAX_NR_CIPHER_SUITES);
5037         if (err)
5038                 return err;
5039
5040         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5041             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5042                 return -EOPNOTSUPP;
5043
5044         wiphy = &rdev->wiphy;
5045
5046         if (info->attrs[NL80211_ATTR_MAC])
5047                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5048         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5049         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5050
5051         if (info->attrs[NL80211_ATTR_IE]) {
5052                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5053                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5054         }
5055
5056         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5057                 connect.channel =
5058                         ieee80211_get_channel(wiphy,
5059                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5060                 if (!connect.channel ||
5061                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5062                         return -EINVAL;
5063         }
5064
5065         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5066                 connkeys = nl80211_parse_connkeys(rdev,
5067                                         info->attrs[NL80211_ATTR_KEYS]);
5068                 if (IS_ERR(connkeys))
5069                         return PTR_ERR(connkeys);
5070         }
5071
5072         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5073                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5074
5075         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5076                 memcpy(&connect.ht_capa_mask,
5077                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5078                        sizeof(connect.ht_capa_mask));
5079
5080         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5081                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5082                         return -EINVAL;
5083                 memcpy(&connect.ht_capa,
5084                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5085                        sizeof(connect.ht_capa));
5086         }
5087
5088         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5089         if (err)
5090                 kfree(connkeys);
5091         return err;
5092 }
5093
5094 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5095 {
5096         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5097         struct net_device *dev = info->user_ptr[1];
5098         u16 reason;
5099
5100         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5101                 reason = WLAN_REASON_DEAUTH_LEAVING;
5102         else
5103                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5104
5105         if (reason == 0)
5106                 return -EINVAL;
5107
5108         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5109             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5110                 return -EOPNOTSUPP;
5111
5112         return cfg80211_disconnect(rdev, dev, reason, true);
5113 }
5114
5115 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5116 {
5117         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5118         struct net *net;
5119         int err;
5120         u32 pid;
5121
5122         if (!info->attrs[NL80211_ATTR_PID])
5123                 return -EINVAL;
5124
5125         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5126
5127         net = get_net_ns_by_pid(pid);
5128         if (IS_ERR(net))
5129                 return PTR_ERR(net);
5130
5131         err = 0;
5132
5133         /* check if anything to do */
5134         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5135                 err = cfg80211_switch_netns(rdev, net);
5136
5137         put_net(net);
5138         return err;
5139 }
5140
5141 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5142 {
5143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5144         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5145                         struct cfg80211_pmksa *pmksa) = NULL;
5146         struct net_device *dev = info->user_ptr[1];
5147         struct cfg80211_pmksa pmksa;
5148
5149         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5150
5151         if (!info->attrs[NL80211_ATTR_MAC])
5152                 return -EINVAL;
5153
5154         if (!info->attrs[NL80211_ATTR_PMKID])
5155                 return -EINVAL;
5156
5157         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5158         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5159
5160         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5161             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5162                 return -EOPNOTSUPP;
5163
5164         switch (info->genlhdr->cmd) {
5165         case NL80211_CMD_SET_PMKSA:
5166                 rdev_ops = rdev->ops->set_pmksa;
5167                 break;
5168         case NL80211_CMD_DEL_PMKSA:
5169                 rdev_ops = rdev->ops->del_pmksa;
5170                 break;
5171         default:
5172                 WARN_ON(1);
5173                 break;
5174         }
5175
5176         if (!rdev_ops)
5177                 return -EOPNOTSUPP;
5178
5179         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5180 }
5181
5182 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5183 {
5184         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5185         struct net_device *dev = info->user_ptr[1];
5186
5187         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5188             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5189                 return -EOPNOTSUPP;
5190
5191         if (!rdev->ops->flush_pmksa)
5192                 return -EOPNOTSUPP;
5193
5194         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
5195 }
5196
5197 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5198 {
5199         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5200         struct net_device *dev = info->user_ptr[1];
5201         u8 action_code, dialog_token;
5202         u16 status_code;
5203         u8 *peer;
5204
5205         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5206             !rdev->ops->tdls_mgmt)
5207                 return -EOPNOTSUPP;
5208
5209         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5210             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5211             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5212             !info->attrs[NL80211_ATTR_IE] ||
5213             !info->attrs[NL80211_ATTR_MAC])
5214                 return -EINVAL;
5215
5216         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5217         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5218         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5219         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5220
5221         return rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
5222                                     dialog_token, status_code,
5223                                     nla_data(info->attrs[NL80211_ATTR_IE]),
5224                                     nla_len(info->attrs[NL80211_ATTR_IE]));
5225 }
5226
5227 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5228 {
5229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5230         struct net_device *dev = info->user_ptr[1];
5231         enum nl80211_tdls_operation operation;
5232         u8 *peer;
5233
5234         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5235             !rdev->ops->tdls_oper)
5236                 return -EOPNOTSUPP;
5237
5238         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5239             !info->attrs[NL80211_ATTR_MAC])
5240                 return -EINVAL;
5241
5242         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5243         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5244
5245         return rdev->ops->tdls_oper(&rdev->wiphy, dev, peer, operation);
5246 }
5247
5248 static int nl80211_remain_on_channel(struct sk_buff *skb,
5249                                      struct genl_info *info)
5250 {
5251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5252         struct net_device *dev = info->user_ptr[1];
5253         struct ieee80211_channel *chan;
5254         struct sk_buff *msg;
5255         void *hdr;
5256         u64 cookie;
5257         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5258         u32 freq, duration;
5259         int err;
5260
5261         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5262             !info->attrs[NL80211_ATTR_DURATION])
5263                 return -EINVAL;
5264
5265         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5266
5267         /*
5268          * We should be on that channel for at least one jiffie,
5269          * and more than 5 seconds seems excessive.
5270          */
5271         if (!duration || !msecs_to_jiffies(duration) ||
5272             duration > rdev->wiphy.max_remain_on_channel_duration)
5273                 return -EINVAL;
5274
5275         if (!rdev->ops->remain_on_channel ||
5276             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5277                 return -EOPNOTSUPP;
5278
5279         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5280                 channel_type = nla_get_u32(
5281                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5282                 if (channel_type != NL80211_CHAN_NO_HT &&
5283                     channel_type != NL80211_CHAN_HT20 &&
5284                     channel_type != NL80211_CHAN_HT40PLUS &&
5285                     channel_type != NL80211_CHAN_HT40MINUS)
5286                         return -EINVAL;
5287         }
5288
5289         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5290         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5291         if (chan == NULL)
5292                 return -EINVAL;
5293
5294         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5295         if (!msg)
5296                 return -ENOMEM;
5297
5298         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5299                              NL80211_CMD_REMAIN_ON_CHANNEL);
5300
5301         if (IS_ERR(hdr)) {
5302                 err = PTR_ERR(hdr);
5303                 goto free_msg;
5304         }
5305
5306         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5307                                            channel_type, duration, &cookie);
5308
5309         if (err)
5310                 goto free_msg;
5311
5312         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5313
5314         genlmsg_end(msg, hdr);
5315
5316         return genlmsg_reply(msg, info);
5317
5318  nla_put_failure:
5319         err = -ENOBUFS;
5320  free_msg:
5321         nlmsg_free(msg);
5322         return err;
5323 }
5324
5325 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5326                                             struct genl_info *info)
5327 {
5328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5329         struct net_device *dev = info->user_ptr[1];
5330         u64 cookie;
5331
5332         if (!info->attrs[NL80211_ATTR_COOKIE])
5333                 return -EINVAL;
5334
5335         if (!rdev->ops->cancel_remain_on_channel)
5336                 return -EOPNOTSUPP;
5337
5338         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5339
5340         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5341 }
5342
5343 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5344                            u8 *rates, u8 rates_len)
5345 {
5346         u8 i;
5347         u32 mask = 0;
5348
5349         for (i = 0; i < rates_len; i++) {
5350                 int rate = (rates[i] & 0x7f) * 5;
5351                 int ridx;
5352                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5353                         struct ieee80211_rate *srate =
5354                                 &sband->bitrates[ridx];
5355                         if (rate == srate->bitrate) {
5356                                 mask |= 1 << ridx;
5357                                 break;
5358                         }
5359                 }
5360                 if (ridx == sband->n_bitrates)
5361                         return 0; /* rate not found */
5362         }
5363
5364         return mask;
5365 }
5366
5367 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5368         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5369                                     .len = NL80211_MAX_SUPP_RATES },
5370 };
5371
5372 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5373                                        struct genl_info *info)
5374 {
5375         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5377         struct cfg80211_bitrate_mask mask;
5378         int rem, i;
5379         struct net_device *dev = info->user_ptr[1];
5380         struct nlattr *tx_rates;
5381         struct ieee80211_supported_band *sband;
5382
5383         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5384                 return -EINVAL;
5385
5386         if (!rdev->ops->set_bitrate_mask)
5387                 return -EOPNOTSUPP;
5388
5389         memset(&mask, 0, sizeof(mask));
5390         /* Default to all rates enabled */
5391         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5392                 sband = rdev->wiphy.bands[i];
5393                 mask.control[i].legacy =
5394                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5395         }
5396
5397         /*
5398          * The nested attribute uses enum nl80211_band as the index. This maps
5399          * directly to the enum ieee80211_band values used in cfg80211.
5400          */
5401         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5402         {
5403                 enum ieee80211_band band = nla_type(tx_rates);
5404                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5405                         return -EINVAL;
5406                 sband = rdev->wiphy.bands[band];
5407                 if (sband == NULL)
5408                         return -EINVAL;
5409                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5410                           nla_len(tx_rates), nl80211_txattr_policy);
5411                 if (tb[NL80211_TXRATE_LEGACY]) {
5412                         mask.control[band].legacy = rateset_to_mask(
5413                                 sband,
5414                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5415                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5416                         if (mask.control[band].legacy == 0)
5417                                 return -EINVAL;
5418                 }
5419         }
5420
5421         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5422 }
5423
5424 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5425 {
5426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5427         struct net_device *dev = info->user_ptr[1];
5428         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5429
5430         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5431                 return -EINVAL;
5432
5433         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5434                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5435
5436         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5437             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5438             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5439             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5440             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5441             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5442             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5443                 return -EOPNOTSUPP;
5444
5445         /* not much point in registering if we can't reply */
5446         if (!rdev->ops->mgmt_tx)
5447                 return -EOPNOTSUPP;
5448
5449         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5450                         frame_type,
5451                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5452                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5453 }
5454
5455 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5456 {
5457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5458         struct net_device *dev = info->user_ptr[1];
5459         struct ieee80211_channel *chan;
5460         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5461         bool channel_type_valid = false;
5462         u32 freq;
5463         int err;
5464         void *hdr = NULL;
5465         u64 cookie;
5466         struct sk_buff *msg = NULL;
5467         unsigned int wait = 0;
5468         bool offchan, no_cck, dont_wait_for_ack;
5469
5470         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
5471
5472         if (!info->attrs[NL80211_ATTR_FRAME] ||
5473             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5474                 return -EINVAL;
5475
5476         if (!rdev->ops->mgmt_tx)
5477                 return -EOPNOTSUPP;
5478
5479         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5480             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5481             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5482             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5483             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5484             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5485             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5486                 return -EOPNOTSUPP;
5487
5488         if (info->attrs[NL80211_ATTR_DURATION]) {
5489                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
5490                         return -EINVAL;
5491                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5492         }
5493
5494         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5495                 channel_type = nla_get_u32(
5496                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5497                 if (channel_type != NL80211_CHAN_NO_HT &&
5498                     channel_type != NL80211_CHAN_HT20 &&
5499                     channel_type != NL80211_CHAN_HT40PLUS &&
5500                     channel_type != NL80211_CHAN_HT40MINUS)
5501                         return -EINVAL;
5502                 channel_type_valid = true;
5503         }
5504
5505         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5506
5507         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
5508                 return -EINVAL;
5509
5510         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5511
5512         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5513         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5514         if (chan == NULL)
5515                 return -EINVAL;
5516
5517         if (!dont_wait_for_ack) {
5518                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5519                 if (!msg)
5520                         return -ENOMEM;
5521
5522                 hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5523                                      NL80211_CMD_FRAME);
5524
5525                 if (IS_ERR(hdr)) {
5526                         err = PTR_ERR(hdr);
5527                         goto free_msg;
5528                 }
5529         }
5530
5531         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5532                                     channel_type_valid, wait,
5533                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5534                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5535                                     no_cck, dont_wait_for_ack, &cookie);
5536         if (err)
5537                 goto free_msg;
5538
5539         if (msg) {
5540                 NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5541
5542                 genlmsg_end(msg, hdr);
5543                 return genlmsg_reply(msg, info);
5544         }
5545
5546         return 0;
5547
5548  nla_put_failure:
5549         err = -ENOBUFS;
5550  free_msg:
5551         nlmsg_free(msg);
5552         return err;
5553 }
5554
5555 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5556 {
5557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5558         struct net_device *dev = info->user_ptr[1];
5559         u64 cookie;
5560
5561         if (!info->attrs[NL80211_ATTR_COOKIE])
5562                 return -EINVAL;
5563
5564         if (!rdev->ops->mgmt_tx_cancel_wait)
5565                 return -EOPNOTSUPP;
5566
5567         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5568             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5569             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5570             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5571             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5572             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5573                 return -EOPNOTSUPP;
5574
5575         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5576
5577         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5578 }
5579
5580 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5581 {
5582         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5583         struct wireless_dev *wdev;
5584         struct net_device *dev = info->user_ptr[1];
5585         u8 ps_state;
5586         bool state;
5587         int err;
5588
5589         if (!info->attrs[NL80211_ATTR_PS_STATE])
5590                 return -EINVAL;
5591
5592         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5593
5594         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5595                 return -EINVAL;
5596
5597         wdev = dev->ieee80211_ptr;
5598
5599         if (!rdev->ops->set_power_mgmt)
5600                 return -EOPNOTSUPP;
5601
5602         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5603
5604         if (state == wdev->ps)
5605                 return 0;
5606
5607         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5608                                         wdev->ps_timeout);
5609         if (!err)
5610                 wdev->ps = state;
5611         return err;
5612 }
5613
5614 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5615 {
5616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5617         enum nl80211_ps_state ps_state;
5618         struct wireless_dev *wdev;
5619         struct net_device *dev = info->user_ptr[1];
5620         struct sk_buff *msg;
5621         void *hdr;
5622         int err;
5623
5624         wdev = dev->ieee80211_ptr;
5625
5626         if (!rdev->ops->set_power_mgmt)
5627                 return -EOPNOTSUPP;
5628
5629         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5630         if (!msg)
5631                 return -ENOMEM;
5632
5633         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5634                              NL80211_CMD_GET_POWER_SAVE);
5635         if (!hdr) {
5636                 err = -ENOBUFS;
5637                 goto free_msg;
5638         }
5639
5640         if (wdev->ps)
5641                 ps_state = NL80211_PS_ENABLED;
5642         else
5643                 ps_state = NL80211_PS_DISABLED;
5644
5645         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5646
5647         genlmsg_end(msg, hdr);
5648         return genlmsg_reply(msg, info);
5649
5650  nla_put_failure:
5651         err = -ENOBUFS;
5652  free_msg:
5653         nlmsg_free(msg);
5654         return err;
5655 }
5656
5657 static struct nla_policy
5658 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5659         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5660         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5661         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5662 };
5663
5664 static int nl80211_set_cqm_rssi(struct genl_info *info,
5665                                 s32 threshold, u32 hysteresis)
5666 {
5667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5668         struct wireless_dev *wdev;
5669         struct net_device *dev = info->user_ptr[1];
5670
5671         if (threshold > 0)
5672                 return -EINVAL;
5673
5674         wdev = dev->ieee80211_ptr;
5675
5676         if (!rdev->ops->set_cqm_rssi_config)
5677                 return -EOPNOTSUPP;
5678
5679         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5680             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5681                 return -EOPNOTSUPP;
5682
5683         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5684                                               threshold, hysteresis);
5685 }
5686
5687 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5688 {
5689         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5690         struct nlattr *cqm;
5691         int err;
5692
5693         cqm = info->attrs[NL80211_ATTR_CQM];
5694         if (!cqm) {
5695                 err = -EINVAL;
5696                 goto out;
5697         }
5698
5699         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5700                                nl80211_attr_cqm_policy);
5701         if (err)
5702                 goto out;
5703
5704         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5705             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5706                 s32 threshold;
5707                 u32 hysteresis;
5708                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5709                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5710                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5711         } else
5712                 err = -EINVAL;
5713
5714 out:
5715         return err;
5716 }
5717
5718 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5719 {
5720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5721         struct net_device *dev = info->user_ptr[1];
5722         struct mesh_config cfg;
5723         struct mesh_setup setup;
5724         int err;
5725
5726         /* start with default */
5727         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5728         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5729
5730         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5731                 /* and parse parameters if given */
5732                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5733                 if (err)
5734                         return err;
5735         }
5736
5737         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5738             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5739                 return -EINVAL;
5740
5741         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5742         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5743
5744         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5745             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
5746                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5747                         return -EINVAL;
5748
5749         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5750                 /* parse additional setup parameters if given */
5751                 err = nl80211_parse_mesh_setup(info, &setup);
5752                 if (err)
5753                         return err;
5754         }
5755
5756         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5757 }
5758
5759 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5760 {
5761         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5762         struct net_device *dev = info->user_ptr[1];
5763
5764         return cfg80211_leave_mesh(rdev, dev);
5765 }
5766
5767 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5768 {
5769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5770         struct sk_buff *msg;
5771         void *hdr;
5772
5773         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5774                 return -EOPNOTSUPP;
5775
5776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5777         if (!msg)
5778                 return -ENOMEM;
5779
5780         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5781                              NL80211_CMD_GET_WOWLAN);
5782         if (!hdr)
5783                 goto nla_put_failure;
5784
5785         if (rdev->wowlan) {
5786                 struct nlattr *nl_wowlan;
5787
5788                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5789                 if (!nl_wowlan)
5790                         goto nla_put_failure;
5791
5792                 if (rdev->wowlan->any)
5793                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5794                 if (rdev->wowlan->disconnect)
5795                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5796                 if (rdev->wowlan->magic_pkt)
5797                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5798                 if (rdev->wowlan->gtk_rekey_failure)
5799                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5800                 if (rdev->wowlan->eap_identity_req)
5801                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5802                 if (rdev->wowlan->four_way_handshake)
5803                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5804                 if (rdev->wowlan->rfkill_release)
5805                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5806                 if (rdev->wowlan->n_patterns) {
5807                         struct nlattr *nl_pats, *nl_pat;
5808                         int i, pat_len;
5809
5810                         nl_pats = nla_nest_start(msg,
5811                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5812                         if (!nl_pats)
5813                                 goto nla_put_failure;
5814
5815                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5816                                 nl_pat = nla_nest_start(msg, i + 1);
5817                                 if (!nl_pat)
5818                                         goto nla_put_failure;
5819                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5820                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5821                                         DIV_ROUND_UP(pat_len, 8),
5822                                         rdev->wowlan->patterns[i].mask);
5823                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5824                                         pat_len,
5825                                         rdev->wowlan->patterns[i].pattern);
5826                                 nla_nest_end(msg, nl_pat);
5827                         }
5828                         nla_nest_end(msg, nl_pats);
5829                 }
5830
5831                 nla_nest_end(msg, nl_wowlan);
5832         }
5833
5834         genlmsg_end(msg, hdr);
5835         return genlmsg_reply(msg, info);
5836
5837 nla_put_failure:
5838         nlmsg_free(msg);
5839         return -ENOBUFS;
5840 }
5841
5842 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5843 {
5844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5845         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5846         struct cfg80211_wowlan no_triggers = {};
5847         struct cfg80211_wowlan new_triggers = {};
5848         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5849         int err, i;
5850
5851         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5852                 return -EOPNOTSUPP;
5853
5854         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5855                 goto no_triggers;
5856
5857         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5858                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5859                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5860                         nl80211_wowlan_policy);
5861         if (err)
5862                 return err;
5863
5864         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5865                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5866                         return -EINVAL;
5867                 new_triggers.any = true;
5868         }
5869
5870         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5871                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5872                         return -EINVAL;
5873                 new_triggers.disconnect = true;
5874         }
5875
5876         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5877                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5878                         return -EINVAL;
5879                 new_triggers.magic_pkt = true;
5880         }
5881
5882         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5883                 return -EINVAL;
5884
5885         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5886                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5887                         return -EINVAL;
5888                 new_triggers.gtk_rekey_failure = true;
5889         }
5890
5891         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5892                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5893                         return -EINVAL;
5894                 new_triggers.eap_identity_req = true;
5895         }
5896
5897         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5898                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5899                         return -EINVAL;
5900                 new_triggers.four_way_handshake = true;
5901         }
5902
5903         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5904                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5905                         return -EINVAL;
5906                 new_triggers.rfkill_release = true;
5907         }
5908
5909         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5910                 struct nlattr *pat;
5911                 int n_patterns = 0;
5912                 int rem, pat_len, mask_len;
5913                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5914
5915                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5916                                     rem)
5917                         n_patterns++;
5918                 if (n_patterns > wowlan->n_patterns)
5919                         return -EINVAL;
5920
5921                 new_triggers.patterns = kcalloc(n_patterns,
5922                                                 sizeof(new_triggers.patterns[0]),